The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from untrusted external sources, creating a surface for indirect prompt injection.
Ingestion points: scripts/fetch_page.py (fetches web content) and scripts/brand_scanner.py (reads local text/HTML files).
Boundary markers: The instructions in SKILL.md and references/skill-contract.md explicitly state to treat scraped text, reviews, and third-party exports as untrusted input and not to follow embedded instructions.
Capability inventory: The skill possesses network read capabilities (scripts/fetch_page.py), local file system access (scripts/brand_scanner.py), and the ability to write findings into the agent context.
Sanitization: No programmatic sanitization or structural isolation is implemented for the ingested text before it is presented to the model.
[DYNAMIC_EXECUTION]: The script scripts/citability_scorer.py uses dynamic module loading which can be used to obfuscate intent.
Evidence: The script uses __import__('sys') to read from standard input. While the usage in this context is benign and limited to a standard library module, dynamic imports are a common technique for bypassing static code analysis.
[EXTERNAL_DOWNLOADS]: The skill includes functionality to download content from arbitrary external URLs.
Evidence: scripts/fetch_page.py uses urllib.request to retrieve content from remote servers.
Mitigation: The utility implements strong security controls, including a validate_url function that blocks non-global IP addresses (preventing SSRF) and disallows URLs with embedded credentials.

geo-content