The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and process content from arbitrary web URLs, creating a surface for indirect prompt injection attacks where malicious instructions embedded in a web page could influence the agent's behavior.
Ingestion points: Untrusted data enters the agent context through the page_reader function and the z-ai-web-dev-sdk library as documented in SKILL.md and scripts/web-reader.ts.
Boundary markers: Implementation patterns in SKILL.md do not include explicit delimiters or instructions to ignore embedded commands, which would help isolate untrusted data from the agent's instruction context.
Capability inventory: The skill possesses the capability to perform network requests via the page_reader function (SKILL.md, scripts/web-reader.ts) and can write output to the local filesystem via the z-ai CLI tool (SKILL.md).
Sanitization: Examples provided in SKILL.md utilize basic regular expressions for HTML tag stripping, which is insufficient for preventing instructions embedded in the text content from being interpreted by the agent.
[EXTERNAL_DOWNLOADS]: The skill relies on the z-ai-web-dev-sdk package and the z-ai CLI tool for web scraping and content management (referenced in SKILL.md and scripts/web-reader.ts).

web-reader