The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (HTML and robots.txt content) which can serve as a vector for indirect prompt injection.
Ingestion points: The skill ingests rendered_dom, raw_html, and the contents of /robots.txt via the WebFetch tool.
Boundary markers: There are no explicit delimiters or instructions provided to the agent to treat this ingested content as data rather than instructions.
Capability inventory: The skill uses Bash to run a local script, performs network requests via WebFetch, and can propose or automatically generate file edits.
Sanitization: No sanitization or validation logic for the fetched content is described in the instructions.
[COMMAND_EXECUTION]: The skill uses the Bash tool to execute a local Node.js script with a template that interpolates a URL variable.
Evidence: The verification command node ${CLAUDE_SKILL_DIR}/../../scripts/parse-robots-sitemap.mjs --url <u> found in SKILL.md uses shell interpolation.
Risk: This pattern represents a potential command injection surface if the <u> variable (provided by a user or external source) is not strictly sanitized by the execution environment.

seo-crawlability