The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted source code (HTML files) to perform audits. This creates a surface for indirect prompt injection where an attacker could embed malicious instructions within the files being audited (e.g., in HTML comments or attributes) to influence the agent's behavior.
Ingestion points: The scripts/analyze.sh script and the agent's instructions in SKILL.md involve reading and processing the user's project files.
Boundary markers: The SKILL.md file contains an "Anti-Patterns" section that explicitly instructs the agent not to treat external content, logs, or tool responses as trusted instructions, which serves as a mitigation.
Capability inventory: The skill uses a shell script (analyze.sh) and provides the agent with the ability to read project files and generate optimization recommendations.
Sanitization: The shell script is written defensively (using set -euo pipefail and safely handling variables in grep and jq), but the primary risk is the LLM's interpretation of the data.
[COMMAND_EXECUTION]: The skill includes and uses a shell script (scripts/analyze.sh) to perform static analysis on project files.
Evidence: The script uses find, grep, and jq to scan HTML files. While the script is read-only and uses safe practices (such as process substitution and jq --arg for JSON construction), it involves executing code in a shell environment.

web-quality-audit