The Agent Skills Directory

[PROMPT_INJECTION]: The skill retrieves content from external RSS/Atom feeds, which introduces an indirect prompt injection surface.
Ingestion points: scripts/fetch_rss.py fetches XML data from arbitrary external URLs.
Boundary markers: The script output does not use protective delimiters or include instructions for the agent to ignore potentially malicious embedded content.
Capability inventory: The skill can perform network requests via urllib.request but lacks capabilities for file system modification or direct command execution.
Sanitization: Feed content is extracted and displayed without escaping or sanitization.
[DATA_EXFILTRATION]: The script fetches data from user-provided URLs using urllib.request. Without restriction to specific domains, this functionality could be used for Server-Side Request Forgery (SSRF) to probe internal network services or cloud metadata endpoints.
[DATA_EXFILTRATION]: The use of xml.etree.ElementTree for parsing untrusted XML data lacks protection against XML External Entity (XXE) attacks, which can lead to local file disclosure or internal network scanning if a malicious feed is processed.

rss-reader