The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to construct and execute shell commands using the Bash tool with variables provided by the user (e.g., $URL, $DOMAIN). These variables are interpolated directly into command strings, such as curl -sI -L "$URL", without specific instructions for sanitization or shell-safe quoting, presenting a command injection risk.
[INDIRECT_PROMPT_INJECTION]: The skill's workflow involves fetching and parsing sitemaps from external domains to identify pages for analysis, which allows untrusted data to influence subsequent system operations.
Ingestion points: The agent fetches sitemap.xml from a target domain and extracts location (<loc>) tags in Phase 1.
Boundary markers: The instructions do not define boundary markers or safety warnings for handling content retrieved from external sources.
Capability inventory: The skill uses Bash (for curl and grep), WebFetch, and Read tools.
Sanitization: URLs extracted from the sitemap are passed directly to the curl tool without validation, which could allow a malicious site to provide crafted links designed to exploit shell command execution.
[DATA_EXFILTRATION]: The skill allows the agent to read from a local file path provided by the user to extract CSP strings. This capability could be exploited to read sensitive system files if the user provides a path to files like environment configurations or credentials, as there are no directory restrictions or file type validations specified.

content-security-policy