The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external websites scraped via the Agent Ready API, which presents a surface for instructions hidden in third-party content.
Ingestion points: Results from the POST /api/v1/scans and GET /api/v1/scans/{id} endpoints, which contain scraped site data such as titles, headings, and manifest file contents.
Boundary markers: The SKILL.md file contains a dedicated "Security & trust" section warning the agent that scan results are untrusted and should be treated as inert data to be summarized.
Capability inventory: The skill utilizes shell commands (curl, jq, grep) and provides Node.js and Python scripts to poll the API and process the returned data.
Sanitization: Explicit instructions are provided to summarize findings rather than displaying raw content, and to disregard any instructions found within the scanned data.
[COMMAND_EXECUTION]: The skill uses shell utilities like curl for network requests, jq for parsing JSON responses, and grep for searching local environment files for configuration.
[CREDENTIALS_UNSAFE]: The skill includes instructions to search for and export API keys (AGENT_READY_API_KEY) from environment variables and .env files. This is used for legitimate authentication with the Agent Ready service provided by the vendor.

agent-ready-api