The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions include a workflow step where the agent is expected to verify backlinks using shell commands. This pattern is vulnerable to command injection if an attacker provides a malicious URL that includes shell metacharacters. Evidence: SKILL.md Step 4, sub-step 6 specifies the command: curl -sIL https://directory.com/your-listing | grep -i rel=.
[EXTERNAL_DOWNLOADS]: The skill's reference files contain a link to a domain that has been flagged as malicious by automated scanners. Evidence: references/directory-list.md and references/submission-tracker-template.csv both list https://fitprofessionals.net in the fitness directory category.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection by processing external data and using it in sensitive operations without adequate safeguards. 1. Ingestion points: Directory URLs are ingested from the references/submission-tracker-template.csv file and user-provided inputs. 2. Boundary markers: The instructions lack delimiters or warnings to ignore instructions embedded in external content. 3. Capability inventory: The skill utilizes shell execution capabilities via the curl command. 4. Sanitization: No sanitization, escaping, or validation logic is provided for the external URLs before they are interpolated into the shell command.

directory-submissions