The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection attack surface by scraping and processing content from external websites supplied by the user.
Ingestion points: In SKILL.md (Step 1), the agent reads raw text content from /tmp/scrape.json generated by the website scraping script.
Boundary markers: Absent. There are no protective delimiters or specific instructions isolating the untrusted website content from the main system context.
Capability inventory: The capability is limited to running the local website scraper via npx tsx and creating a structured profile file (client-profile.yaml). No administrative or sensitive network write-back operations are exposed.
Sanitization: Absent. The script scripts/scrape-website.ts uses regex to remove HTML markup tags, but passes all underlying text content verbatim into the JSON output without further validation.
[COMMAND_EXECUTION]: In SKILL.md (Step 1), the skill instructs the agent to invoke a local script using shell commands: npx tsx scripts/scrape-website.ts --url=https://example.com --out=/tmp/scrape.json. Interpolating user-supplied input directly into a command line template creates an injection surface if the executing agent platform doesn't adequately sanitize arguments before shell execution.

icp-onboarding