The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The script scripts/fetch_url.py performs network requests to external URLs provided by the user.
[EXTERNAL_DOWNLOADS]: The fetch_with_urllib function in scripts/fetch_url.py explicitly disables SSL certificate verification by setting verify_mode = ssl.CERT_NONE and check_hostname = False. This configuration allows an attacker to intercept or modify the traffic via man-in-the-middle attacks.
[PROMPT_INJECTION]: The skill presents an attack surface for indirect prompt injection (Category 8) because it retrieves untrusted content from the web and provides it to the agent. \n
Ingestion points: Data is fetched from arbitrary remote URLs in scripts/fetch_url.py. \n
Boundary markers: The skill does not implement delimiters or specific instructions to the agent to ignore commands embedded within the scraped content. \n
Capability inventory: The skill performs network operations and parses HTML content. \n
Sanitization: No sanitization is performed on the fetched content to neutralize potential malicious instructions before they are processed by the agent.

web-scraper