The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes HTML content from external websites via scripts/audit-markup.mjs and scripts/check-links.mjs. This creates a surface for indirect prompt injection where malicious instructions on a scanned site could attempt to influence the agent's behavior during the audit.
Ingestion points: The skill uses the fetch API and Playwright browser automation (in scripts/lib/pages.mjs) to retrieve content from user-provided URLs.
Boundary markers: No explicit delimiters or instructions are used to isolate the scraped content or warn the agent to ignore instructions embedded within the site data.
Capability inventory: The agent is instructed to execute local Node.js scripts and perform modifications to the user's project files based on the audit findings.
Sanitization: The skill performs HTML parsing but does not include sanitization to prevent potential instructions from being interpreted as agent prompts.
[DYNAMIC_EXECUTION]: The scripts/lib/browser.mjs script performs dynamic loading of the playwright or playwright-core libraries using createRequire().resolve() at runtime. While this supports the skill's browser-based auditing functionality, it involves loading code from computed paths.
[COMMAND_EXECUTION]: The skill instructions in SKILL.md direct the agent to execute shell commands to run the provided Node.js audit scripts, such as node scripts/check-links.mjs and node scripts/audit-markup.mjs.
[DATA_EXFILTRATION]: The skill performs network operations using the fetch API (in scripts/lib/pages.mjs) to request content from external URLs provided by the user. While these requests are functional for site auditing, they represent outgoing network traffic to non-whitelisted domains.

content-trust