The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted data from external websites, which serves as a primary vector for indirect prompt injection.
Ingestion points: The skill fetches external content using WebFetch and seo-crawl-render to build a PageSnapshot from arbitrary URLs or local paths as described in SKILL.md.
Boundary markers: The instructions do not define any specific delimiters or instructions to the agent to treat the fetched data as untrusted content, potentially allowing embedded instructions to be executed by the subagents.
Capability inventory: The orchestrator utilizes the Task, WebFetch, Read, Grep, and Glob tools. While it can read local files and fetch remote data, it is explicitly restricted from using file-modification tools like Write or Edit, which prevents the mutation of the local filesystem.
Sanitization: There is no evidence of sanitization, filtering, or validation of the raw HTML and rendered DOM content before it is passed to the specialist subagents for synthesis.

seo-orchestrator