The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to fetch and process content from arbitrary, untrusted external URLs, which provides a direct vector for indirect prompt injection attacks.
Ingestion points: The scripts scripts/fetch.js, scripts/links.js, and scripts/metadata.js (along with their .cjs equivalents) all perform network requests to retrieve data from external web pages.
Boundary markers: The extracted content is returned to the agent without any delimiters or specific instructions to treat the data as untrusted, increasing the risk that the agent will follow embedded commands.
Capability inventory: The skill utilizes the fetch API to perform network operations. While it does not directly write to the filesystem or execute shell commands, the data it provides can influence the agent to use other capabilities maliciously.
Sanitization: The scripts perform basic HTML cleaning by stripping <script> and <style> tags, but they do not sanitize the resulting text for natural language instructions or prompt injection patterns.

web-scraper