The Agent Skills Directory

[PROMPT_INJECTION]: The skill is highly susceptible to indirect prompt injection (Category 8) because its core function is to ingest untrusted content from the web and process it using AI prompts. A malicious website could embed instructions designed to manipulate the agent's behavior during the extraction phase.
Ingestion points: Data enters through WebFetch, navigate, and curl operations on user-provided URLs.
Boundary markers: The skill uses basic prompts like 'Extract [DATA_TARGET] from this page' but lacks robust isolation or sanitization for the content being analyzed.
Capability inventory: The skill can execute shell commands (bash), browser JavaScript (javascript_tool), and perform local file writes.
Sanitization: While it includes data cleaning (whitespace, HTML entities), it lacks security-focused sanitization to prevent instruction leakage from scraped data.
[COMMAND_EXECUTION]: The skill utilizes the shell to perform data processing tasks. Specifically, it uses curl to fetch remote data and pipes it into jq or python3 -c for parsing. This represents dynamic execution of code strings to handle XML or JSON data, which could be exploited if the source data is specifically crafted to target the parser.
[EXTERNAL_DOWNLOADS]: The skill is designed to download content from arbitrary external URLs provided by the user. While this is the intended purpose, the skill includes logic to automatically 'escalate' from static fetching to browser automation, which increases the execution risk profile when visiting unknown sites.
[DATA_EXFILTRATION]: The skill has the capability to read content from the web and save it to local files (e.g., /tmp/scraped_data.csv). Although it includes warnings about sensitive data (emails/phones), the combined capability of reading from a network and writing to a file is a classic data handling pattern that requires user oversight.

web-scraper