The Agent Skills Directory

[SAFE]: The skill correctly uses the allowed-tools frontmatter field to restrict bash execution to the squirrel binary, following the principle of least privilege.
[PROMPT_INJECTION]: The skill has an inherent surface for indirect prompt injection because it processes untrusted content from external websites and then suggests the agent apply code fixes based on that content.
Ingestion points: Data enters the agent's context through the output of squirrel audit and squirrel report commands which crawl external URLs (SKILL.md).
Boundary markers: The output uses a structured XML hybrid format (as described in OUTPUT-FORMAT.md) to delineate audit results, which provides some structural separation between the tool's analysis and the site's content.
Capability inventory: The agent is authorized to use Edit, Read, Grep, and Glob tools to modify local source code in the project (SKILL.md).
Sanitization: The instructions do not explicitly require the agent to sanitize or validate extracted strings (like meta titles or alt text) before interpolating them into code during the 'fix' phase.

audit-website