The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it fetches and processes untrusted text from external websites.
Ingestion points: Data enters the agent's context through the output of scripts/fetch_cfp.py (file: SKILL.md).
Boundary markers: There are no explicit delimiters or instructions to ignore embedded commands within the fetched CFP text.
Capability inventory: The skill can execute local Python scripts (scripts/fetch_cfp.py, tools/validate_venues.py) and perform file system writes to the venues/ directory.
Sanitization: The skill performs no filtering or sanitization on the extracted text before it is interpreted by the agent.
[EXTERNAL_DOWNLOADS]: The skill performs network operations to fetch content from arbitrary URLs provided by the user.
The script scripts/fetch_cfp.py uses urllib.request to connect to external domains which could lead to SSRF if the environment is not isolated.
[COMMAND_EXECUTION]: The skill requires the agent to execute bundled Python scripts to perform fetching and validation tasks.
Evidence: python3 scripts/fetch_cfp.py "<cfp-url>" and python3 tools/validate_venues.py (file: SKILL.md).

parse-cfp