The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches content from arbitrary external URLs. The instructions in SKILL.md explicitly suggest using this tool to bypass network restrictions encountered by built-in tools, indicating its use as an egress bypass mechanism.
[EXTERNAL_DOWNLOADS]: The fallback fetcher implementation in scripts/fetch_url.py (using urllib) explicitly disables SSL certificate verification by setting verify_mode = ssl.CERT_NONE and check_hostname = False. This allows for Man-in-the-Middle (MitM) attacks where an attacker can intercept and modify the content of the web pages being fetched.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted data from the internet for agent consumption.
Ingestion points: Content is fetched from arbitrary URLs via scripts/fetch_url.py.
Boundary markers: None. The fetched content is converted to markdown and returned to the agent without any delimiters or instructions to ignore embedded commands.
Capability inventory: The agent can execute python scripts and use shell commands as shown in the workflow.
Sanitization: While the script removes HTML tags like <script>, it does not sanitize the resulting markdown text for instructional content that could manipulate the agent's behavior.
[COMMAND_EXECUTION]: The SKILL.md file instructs the agent to execute multiple fetch commands in parallel using shell background processes (& and wait), which increases the complexity of monitored execution and potential for resource exhaustion.

read-web-scraper