The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes content from untrusted external websites, such as llms.txt, agents.md, and JSON-based agent profiles. This creates a potential surface for indirect prompt injection if an attacker-controlled website provides files containing malicious instructions intended to subvert the agent's behavior during the auditing process.
Ingestion points: External site content is ingested from <run_dir>/site/discovery.json, which contains the raw bodies and metadata of various probed files.
Boundary markers: The instructions do not define any specific boundary markers or delimiters to isolate untrusted external content from the agent's operational instructions.
Capability inventory: The skill utilizes the Bash, Read, Grep, and Glob tools and has the capability to generate code fixes or configuration changes.
Sanitization: No sanitization, escaping, or validation of the external content is described prior to its analysis by the agent.
[COMMAND_EXECUTION]: The skill uses the Bash tool to execute Node.js scripts (snapshot.mjs and ai-discovery.mjs) located in paths determined by environment variables such as ${CLAUDE_PLUGIN_ROOT}. While these appear to be internal tool scripts, the execution of commands via a shell using environment-dependent paths is a significant capability.

seo-ai-discovery