The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data, including domain names provided by the user and potentially data exports from third-party services like Similarweb, Ahrefs, or Semrush.
Ingestion points: Domain names in input; authorized data exports (Similarweb, Ahrefs, etc.) mentioned in the 'Retrieve evidence through SandBase' section of SKILL.md.
Boundary markers: The skill instructs the agent to 'Normalize input domains' but does not explicitly use delimiters for all processed data points.
Capability inventory: Uses specific SandBase tools (e.g., sandbase_run) and REST endpoints for data retrieval. It does not have arbitrary code execution or file system write capabilities.
Sanitization: Instructs normalization of domains by removing protocols and paths, which reduces some injection surface.
[EXTERNAL_DOWNLOADS]: The skill communicates with the official vendor API at api.sandbase.ai to retrieve traffic estimates. This is a legitimate operational requirement for the skill's purpose.
[SAFE]: The skill contains explicit instructions to protect credentials, directing the agent to use environment variables for SANDBASE_API_KEY and forbidding asking the user for the key or exposing it in any output.

similarweb-analytics