The Agent Skills Directory

[PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it ingests and processes untrusted data from external SaaS websites during the study process.
Ingestion points: Untrusted data enters the context through fetch_public.py (fetching robots.txt and sitemaps) and extract_html.py (processing site HTML).
Boundary markers: Processed content is delimited and stored in specific files (e.g., extracted/*.md) before being read by the agent.
Capability inventory: The skill has access to shell execution via Bash(python3:*) and file system writes.
Sanitization: The skill includes automated scrubbing for credentials and PII (via scrub_network.py and redact_screenshot.py), although it does not filter instructions. The risk is significantly mitigated by the structured multi-phase workflow and the requirement for user interaction during authenticated capture.
[DATA_EXPOSURE]: While the skill is designed to capture authenticated session data, it follows best practices to prevent accidental exposure. It stores artifacts in a local directory (./saas-library/) which is automatically added to .gitignore. Furthermore, it provides automated scripts to strip Authorization headers, Cookies, and JWTs from captured network traffic before the final report is generated.
[EXTERNAL_DOWNLOADS]: The skill's installation process (scripts/install.sh) downloads standard, well-known Python packages (such as trafilatura, beautifulsoup4, and jinja2) from the official PyPI registry to handle text extraction and report templating.

saas-study