The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data, which is a common surface for indirect prompt injection.
Ingestion points: The skill fetches web content via scripts/fetch_page.py and reads local text/HTML files via scripts/brand_scanner.py and scripts/citability_scorer.py.
Boundary markers: SKILL.md and references/skill-contract.md include explicit instructions to treat scraped material as untrusted input and to not follow embedded instructions from evidence.
Capability inventory: The skill has network read capabilities (fetch_page.py) and local file read/write capabilities (schema_generator.py, generate_markdown_report.py).
Sanitization: scripts/fetch_page.py implements robust SSRF protection by validating URLs and blocking non-global IP addresses. scripts/schema_generator.py uses JSON-encoding to escape data before injecting it into templates.
[DYNAMIC_EXECUTION]: Static analysis identified the use of __import__ in scripts/citability_scorer.py.
Evidence: The script uses __import__('sys').stdin.read() to handle piped input if no file argument is provided.
Context: This is a standard and safe implementation for CLI tools to read from standard input and does not represent a security risk.
Additionally, scripts/generate_pdf_report.py dynamically attempts to import the reportlab library, which is a legitimate way to handle optional external dependencies.

geo-schema