The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill represents an indirect prompt injection surface as it ingests and processes untrusted data from remote target URLs. A malicious target server could provide crafted responses (HTML, JS, or JSON) designed to influence the agent's behavior or output.
Ingestion points: The scripts/agent.py script (using requests.get) and the SKILL.md workflow (using curl) fetch content from user-provided target URLs.
Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are present in the processing logic.
Capability inventory: The skill possesses capabilities for network operations (requests, curl), filesystem writes (generate_report function), and shell command execution (grep, jq, git-dumper).
Sanitization: Content is analyzed via regex patterns and JSON key extraction, but raw response content from external servers is not sanitized before processing.
[COMMAND_EXECUTION]: The workflow in SKILL.md contains complex shell command pipelines (using curl, grep, tr, and while loops) that execute logic based on data fetched from remote sources.
[EXTERNAL_DOWNLOADS]: The skill's primary function involves downloading resources from external targets, including JavaScript files, environment configurations (.env), and version control metadata (.git).
[METADATA_POISONING]: There is a discrepancy in the skill metadata where the author name provided in the YAML frontmatter (mahipal) does not match the author name in the license file and context (mukul975).

testing-for-sensitive-data-exposure