The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection by processing untrusted link data from external webpages. Malicious content could be used to trigger unintended network requests.
Ingestion points: The skill navigates to external URLs using mcp__playwright__browser_navigate and extracts link data from the DOM via mcp__playwright__browser_evaluate (SKILL.md, Workflow Steps 1 & 2).
Boundary markers: Absent. There are no instructions to the agent to treat page content as untrusted or to ignore specific types of discovered links.
Capability inventory: The skill utilizes mcp__playwright__browser_navigate, browser-based fetch calls, and shell-based curl commands to interact with the network.
Sanitization: The logic only checks for http and https protocols in JavaScript but does not filter for internal IP ranges, loopback addresses, or sensitive hostnames before passing them to curl or fetch.
[DATA_EXFILTRATION]: The automated verification of links extracted from untrusted pages creates a Server-Side Request Forgery (SSRF) vulnerability. A malicious page could list internal network resources (such as 127.0.0.1 or 169.254.169.254) as links. The skill would then use curl or browser fetch to request these resources, potentially exposing the existence or status of internal services to the user or agent output.
[COMMAND_EXECUTION]: The skill executes shell commands using curl with URL arguments derived from untrusted webpage content. While the workflow suggests quoting the URL variable ("$URL"), a malicious URL could be crafted to include command-line arguments that alter the behavior of the curl utility (e.g., using a URL starting with a dash if not properly handled), presenting a risk of environment manipulation. Additionally, the skill performs dynamic execution by running a JavaScript snippet within the browser context using mcp__playwright__browser_evaluate.

broken-link-scan