The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to interpolate a user-provided {URL} directly into a shell command (npx -y url-to-markdown-cli-tool {URL}). This is highly susceptible to command injection if the input contains shell metacharacters (e.g., ; rm -rf /), allowing for arbitrary code execution on the host machine.
[REMOTE_CODE_EXECUTION]: The skill utilizes npx -y to download and execute an external, unverified package (url-to-markdown-cli-tool) from the public npm registry at runtime. This poses a supply chain risk as the package content is not pinned to a specific version or hash, and its source is not a trusted vendor.
[EXTERNAL_DOWNLOADS]: Fetches and executes remote code from the npm registry every time the skill is invoked, which can be exploited if the package is hijacked or replaced with a malicious version.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection.
Ingestion points: Untrusted web content fetched via the conversion tool (SKILL.md, Workflow 1).
Boundary markers: None present; the skill treats the tool's output as the source of truth without wrapping it in delimiters or providing instructions to ignore embedded commands.
Capability inventory: The agent has shell execution capabilities (npx) and file-writing capabilities (> page.md).
Sanitization: No sanitization, validation, or escaping of the fetched Markdown content is performed before it is presented to the agent.

get-web-page