The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external websites and customer documents for inclusion in local files.
Ingestion points: SKILL.md (Audit Mode Phase 1) fetches content from user-provided URLs and accepts raw customer materials such as interview notes and support tickets.
Boundary markers: The instructions do not define boundary markers or provide warnings to the agent to treat the ingested content as potentially malicious.
Capability inventory: The skill utilizes Write to create HTML files and Bash(open *) to launch them.
Sanitization: There is no evidence of sanitization or escaping of the fetched content before it is injected into the HTML artifact template.
[DYNAMIC_EXECUTION]: The skill performs runtime generation and execution of a local HTML file that incorporates external, unsanitized content.
Execution method: The instructions for delivering the artifact (Phase 6 of Compose and Phase 4 of Audit) direct the agent to write a file and open it using a shell command.
Risk: Malicious scripts present in the audited web pages or customer materials could execute in the browser context when the user opens the generated artifact.
[COMMAND_EXECUTION]: The skill directs the agent to execute shell commands to interact with the host operating system.
Evidence: SKILL.md uses the open command within the Bash(open *) tool to present the generated HTML reports to the user.

language-market-fit