The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill fetches article content from user-provided URLs, creating a surface for malicious instructions to enter the agent's context.
Ingestion points: Content is read from external websites via tools like reader, trafilatura, or curl in SKILL.md.
Boundary markers: The skill lacks explicit delimiters or instructions to warn the agent that extracted content might contain instructions that should be ignored.
Capability inventory: The agent has access to Bash and Write tools, which could be abused if malicious instructions in an article are followed.
Sanitization: The skill sanitizes filenames but does not sanitize or filter the extracted text content for prompt injection patterns before the agent processes it.
[COMMAND_EXECUTION]: The workflow involves executing shell commands with user-supplied URLs (e.g., reader "$ARTICLE_URL"). While the skill uses double quotes to mitigate basic injection, complex payloads in the URL could still pose a risk in certain shell environments.
[EXTERNAL_DOWNLOADS]: The skill's primary function is to download data from arbitrary external URLs. While this is the intended behavior, it involves interaction with untrusted remote infrastructure and installation of external packages like trafilatura and reader-cli.

article-extractor