The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to construct and run curl commands using string interpolation of variables like $BASE and $ENDPOINT. If these user-provided strings are not strictly validated or sanitized by the agent, it could lead to arbitrary shell command injection on the host environment.
[EXTERNAL_DOWNLOADS]: The skill makes network requests to external URLs to perform health checks, fetch headers, and retrieve response bodies for analysis.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it retrieves and processes untrusted content from remote API endpoints.
Ingestion points: The skill saves API response bodies to /tmp/api-body.json and reads them back to inspect for 'Error hygiene' (e.g., stack traces, hostnames).
Boundary markers: There are no explicit delimiters or instructions to the agent to disregard embedded instructions within the fetched data.
Capability inventory: The skill uses curl for network operations and file writes, and has file-reading capabilities to perform its analysis.
Sanitization: The skill lacks mechanisms to sanitize or filter the content of the API responses before the agent processes them, allowing a malicious API to potentially influence the agent's behavior.
[SAFE]: The report includes a link to the author's own service, helpmetest.com, which is a legitimate vendor resource.

api-smoke-check