The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its core functionality of reading and processing untrusted HTML files.
Ingestion Points: In SKILL.md, Step 1 instructions command the agent to read external HTML files provided by the user using the read and glob tools.
Boundary Markers: Absent. The skill does not instruct the agent to use delimiters or specific ignore-tags (e.g., 'treat the following as data only') when processing the HTML content, meaning malicious instructions embedded in HTML comments or text could influence the agent's behavior.
Capability Inventory: The skill has high-privilege tool access, specifically write, edit, and bash. In SKILL.md (Step 11), it explicitly uses the edit tool to modify the files it has just read.
Sanitization: Absent. The skill performs direct analysis on the raw content of the ingested files for keywords and structure without sanitizing the input against prompt injection patterns.

lp-seo