The Agent Skills Directory

[COMMAND_EXECUTION]: The shell scripts provided in SKILL.md for extraction and filename creation interpolate the $ARTICLE_URL and $URL variables directly into bash commands. If these variables are populated with user input containing shell metacharacters (e.g., backticks, dollar signs, or semicolons), it could lead to arbitrary command execution in the environment.
[PROMPT_INJECTION]: The skill extracts content from arbitrary external URLs, creating a vulnerability surface for indirect prompt injection where malicious instructions embedded in a web page could influence the agent's behavior.
Ingestion points: External article content is fetched via curl, reader, or trafilatura and processed in the shell and Python scripts within SKILL.md.
Boundary markers: Absent. The extracted content is saved to files and previewed without the use of delimiters or 'ignore' instructions to prevent the agent from following commands found within the article text.
Capability inventory: The skill is granted Bash and Write tool permissions, enabling it to perform network requests, file system operations, and execute system commands.
Sanitization: Absent. The skill performs basic HTML tag removal but does not sanitize the text for potentially malicious instructions before presenting it to the agent.
[EXTERNAL_DOWNLOADS]: The skill instructs the agent to install external software packages if they are not present, increasing the attack surface of the environment.
Evidence: Recommends installation of @mozilla/readability-cli and reader-cli via npm, and trafilatura via pip3.
[REMOTE_CODE_EXECUTION]: The fallback extraction method pipes data directly from a network request into an inline Python execution environment.
Evidence: curl -s "$ARTICLE_URL" | python3 -c "..." pattern used in the 'Complete Workflow' section of SKILL.md.

article-extractor