The Agent Skills Directory

[PROMPT_INJECTION]: The skill uses instructions that encourage the agent to adopt a "Bounty Hunter Perspective" and look for ways to "abuse" the forms, which is a role-play framing for its analytical purpose. It also presents an indirect prompt injection surface because it processes untrusted HTML data from external files that could contain malicious instructions designed to influence the agent's interpretation of the resulting security report. \n
Ingestion points: The src/analyzer.ts script reads file content using fs.readFileSync.\n
Boundary markers: The analysis report is structured with Markdown headers and tables to separate parsed data from the report structure.\n
Capability inventory: The skill can read local files and output text to the console.\n
Sanitization: It uses the cheerio library for structured HTML parsing, providing basic structural validation of the input data.
[DATA_EXFILTRATION]: The skill accesses local HTML files for analysis using fs.readFileSync in src/analyzer.ts. While this is the intended function of a static analyzer, it involves reading user-provided file paths into the agent context.
[COMMAND_EXECUTION]: The SKILL.md file provides instructions for installing and running the analyzer using shell commands like npm install, npm run build, and npx tsx, which involve executing code within the local environment.

form-security-analyzer