The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses shell commands for target reconnaissance.
Evidence: curl -s "https://target.com/robots.txt" and curl -sI "https://target.com" | grep -iE "server|x-powered|cf-ray|set-cookie" are used to inspect site configurations and protection mechanisms.
[EXTERNAL_DOWNLOADS]: The skill requires the installation of several external libraries to function.
Evidence: The instructions explicitly require pip install beautifulsoup4 lxml requests and npm install -g playwright to set up the extraction environment.
[DATA_EXFILTRATION]: The primary purpose of the skill is to extract data from external domains and bring it into the agent's context.
Evidence: The workflow is designed to pull structured data (JSON/CSV) from third-party URLs to the user's environment. While the skill includes prohibitions against harvesting PII at scale, the data flow is fundamentally outward-to-inward.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes content from untrusted external sources.
Ingestion points: SKILL.md defines workflows using Playwright, curl, and BeautifulSoup to read HTML, JavaScript, and API responses from the open web.
Boundary markers: While the skill suggests schema design and validation, it lacks explicit instructions to treat scraped text as data rather than instructions, which could allow an attacker to influence the agent by embedding prompts in a website's content.
Capability inventory: The skill has the capability to write files, perform network operations, and execute dynamically generated scraping scripts.
Sanitization: No explicit sanitization of website content to strip hidden LLM instructions is present in the workflow.

ghost-scraper