The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external websites and search results, which could contain malicious instructions designed to manipulate the agent's behavior.
Ingestion points: Web content fetched via scripts/fetch.py and search result snippets returned by scripts/search.py.
Boundary markers: Partial. scripts/fetch.py uses horizontal rules (---) and truncation notices, but does not wrap content in specialized tags or provide 'ignore instructions' warnings to the agent.
Capability inventory: Both scripts/fetch.py and scripts/search.py have file system write capabilities (via the --output flag) and perform network operations.
Sanitization: scripts/fetch.py removes certain HTML tags (e.g., <script>, <style>, <nav>), but does not filter or sanitize the final text output for malicious natural language prompts.
[COMMAND_EXECUTION]: The search and fetch scripts allow users or agents to specify an output file path via the -o or --output flags. The scripts use Path(args.output).write_text() without sanitizing the provided path, which could potentially allow overwriting sensitive files within the agent's accessible environment if the agent is misled into providing a critical system path.
[EXTERNAL_DOWNLOADS]: The skill is designed to download content from arbitrary external URLs provided by the user or identified during searches using the requests library and the ddgs search backend. While this is the primary intended function of the skill, it represents a standard external data ingestion surface.

web-search