The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from web pages and metadata by reading HTML/JSON files and resolving external sameAs URLs found within them. Maliciously crafted instructions embedded in these external sources could influence the agent's behavior.
Ingestion points: The skill reads page content from <run_dir>/pages/<slug>.html and <run_dir>/pages/<slug>.json, and performs network lookups on URLs discovered in the sameAs property.
Boundary markers: No specific delimiters or instructions to ignore embedded commands are defined for processing the ingested web content.
Capability inventory: The skill is granted Bash access and uses it to execute a snapshotting script (node "${CLAUDE_PLUGIN_ROOT}/scripts/snapshot.mjs"). It also has WebFetch for network operations.
Sanitization: The instructions do not specify any sanitization or validation steps for the content retrieved from external URLs before it is processed by the model.
[COMMAND_EXECUTION]: The skill utilizes a Bash tool to execute a local snapshotting script. While this is part of its core functionality, the combination of shell access with the processing of untrusted external data increases the potential impact of an injection attack.

seo-entity-linking