The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions in SKILL.md (Step 3) direct the agent to execute a shell command: python scripts/fetch_page.py <URL>. This pattern is highly susceptible to command injection if the <URL> placeholder is replaced with a malicious string (e.g., https://example.com; rm -rf /) and executed in a shell environment without rigorous escaping or sanitization of the user-provided input.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function involves fetching HTML content from external, user-supplied URLs and incorporating that content into the agent's context for auditing. This creates a surface for indirect prompt injection where a malicious website could embed hidden instructions designed to manipulate the agent's scorecard or subsequent actions.
Ingestion points: The scripts/fetch_page.py script retrieves raw HTML and text content from the target URL, which is then processed by the agent.
Boundary markers: The skill does not define clear delimiters or "ignore instructions" warnings for the fetched content before it is processed.
Capability inventory: The agent has access to shell execution (bash), file system access, and network operations via web_fetch and the provided scripts.
Sanitization: The fetch_page.py script performs regex extraction for metadata, but the core analysis relies on the agent reading the ingested body text.
[EXTERNAL_DOWNLOADS]: The scripts/fetch_page.py utility uses the Python urllib.request library to perform network requests to arbitrary external domains. While this is the intended purpose for auditing, it allows the agent to interact with untrusted external servers and potentially be used for SSRF (Server-Side Request Forgery) if the agent is tricked into fetching internal or sensitive URLs.

optise-helix-race-audit