The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze content from external, untrusted webpages, which creates a vulnerability to indirect prompt injection attacks.
Ingestion points: The scripts/fetch_page.py script retrieves webpage metadata (titles, headings, meta tags, and schema) and provides it to the agent in JSON format for analysis and scoring. This content is then incorporated into the agent's context.
Boundary markers: The skill does not employ explicit boundary markers or delimiters when presenting the extracted webpage content to the agent, increasing the risk that the agent may follow instructions embedded within the target page's text.
Capability inventory: The skill can execute local Python scripts and perform network requests to any URL specified by the user.
Sanitization: While the Python script uses regular expressions to strip HTML tags from extracted headings, it does not sanitize the text content for potentially malicious natural language instructions.
[COMMAND_EXECUTION]: The skill requires the agent to execute a local Python script with user-provided input.
Evidence: The workflow in SKILL.md (Step 3) specifies the execution of python scripts/fetch_page.py <URL>.
Risk: This pattern creates a potential for command injection if the user-supplied URL contains shell metacharacters and the execution environment does not provide adequate sanitization before passing arguments to the shell.
[EXTERNAL_DOWNLOADS]: The skill performs network operations to retrieve content from external URLs provided by the user.
Analysis: This behavior is fundamental to the skill's intended purpose (auditing webpages). The scripts/fetch_page.py script uses the Python standard library's urllib.request to fetch HTML content and implements retry logic with User-Agent rotation. No direct execution of remote code (e.g., piping a download to a shell) was detected.

optise-helix-fitq-audit