The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests and processes untrusted data from the internet. \n- Ingestion points: The agent retrieves content from arbitrary URLs provided by users via curl, reader, or trafilatura in SKILL.md. \n- Boundary markers: Instructions do not include delimiters or protective prompts to prevent the agent from executing instructions contained within the extracted articles. \n- Capability inventory: The agent has access to Bash and Write tools, which could be misused if the agent obeys malicious instructions found in articles. \n- Sanitization: Extracted text is shown to the agent in a preview without sanitization or escaping of potential instructions. \n- [COMMAND_EXECUTION]: The skill constructs shell commands by interpolating untrusted external data. \n- Evidence: The workflow in SKILL.md incorporates $ARTICLE_URL and $TITLE (extracted from the web) directly into shell commands. A carefully crafted URL or title could attempt to manipulate the shell execution environment. \n- [DYNAMIC_EXECUTION]: The skill generates and executes scripts at runtime. \n- Evidence: The fallback extraction method in SKILL.md writes a Python script for HTML parsing and executes it using the python3 -c command. \n- [UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The skill suggests the installation of external packages. \n- Evidence: The instructions recommend installing the @mozilla/readability-cli package via npm and the trafilatura package via pip to facilitate article extraction.

article-extractor