The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted HTML content from external URLs and processes it into markdown for display to the agent. This represents a classic indirect prompt injection surface where a malicious website could include hidden instructions within HTML tags or comments intended to influence the agent's subsequent behavior.
Ingestion points: scripts/fetch_url.py fetches data via the requests and urllib libraries based on user-provided URLs.
Boundary markers: The skill converts HTML to markdown but does not wrap the resulting output in clear delimiters or include 'ignore embedded instructions' warnings for the agent.
Capability inventory: The skill possesses network read capabilities and local file system access (for execution).
Sanitization: The script performs structural sanitization by filtering specific tags (e.g., <script>, <style>, <iframe>), which mitigates some direct code execution risks but does not address natural language instruction injection.
[REMOTE_CODE_EXECUTION]: While no direct remote code execution was found, the fallback fetching function fetch_with_urllib in scripts/fetch_url.py explicitly disables SSL certificate verification (ssl.CERT_NONE). This makes the skill vulnerable to Man-in-the-Middle (MitM) attacks when the requests library is unavailable, potentially allowing an attacker to intercept or modify the fetched web content.

web-scraper