The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses curl to fetch content from https://defuddle.md/, a third-party markdown extraction service.
[COMMAND_EXECUTION]: The skill defines a shell command execution pattern curl -sL "https://defuddle.md/<url>" where <url> is derived from user input in SKILL.md. This presents a risk of command injection if the agent does not adequately escape shell metacharacters provided in the URL (e.g., ;, &, or backticks).
[DATA_EXFILTRATION]: The skill is designed to send target URLs to a third-party service (defuddle.md). While it contains instructions to avoid sensitive or private URLs, the mechanism provides a path for potential exposure of internal or credentialed URLs to an external party.
[INDIRECT_PROMPT_INJECTION]: The skill ingests arbitrary data from external websites. Ingestion points: Content retrieved from URLs via the curl command in SKILL.md. Boundary markers: No markers or delimiters are specified to isolate the retrieved content from the agent's instructions. Capability inventory: The skill can execute shell commands via curl. Sanitization: No sanitization or filtering of the retrieved content is described.

url-reader