The Agent Skills Directory

[COMMAND_EXECUTION]: The script prompt-engineer-toolkit/scripts/prompt_tester.py contains functionality to execute an external command provided by the user via the --runner-cmd argument.
Evidence: Use of subprocess.run(parts, ...) where parts is derived from a formatted string containing user-controlled runner_cmd, prompt, and input.
This allows arbitrary code execution on the local machine if the command template is manipulated or if the tool is used to call dangerous binaries.
[EXTERNAL_DOWNLOADS]: Several automation tools fetch content from the web for analysis.
Evidence: site-architecture/scripts/sitemap_analyzer.py, seo-audit/scripts/seo_checker.py, and page-cro/scripts/conversion_audit.py all use urllib.request.urlopen to download XML and HTML content from provided URLs.
While consistent with the tools' purpose (SEO and CRO auditing), this allows the skill to initiate outbound network connections to any host.
[INDIRECT_PROMPT_INJECTION]: The skill architecture creates a surface for indirect prompt injection by processing untrusted data from external websites.
Ingestion points: sitemap_analyzer.py, seo_checker.py, and conversion_audit.py read content from arbitrary URLs provided as arguments.
Boundary markers: The analytical prompts for these tools do not appear to use robust delimiters or instructions to ignore embedded commands within the ingested HTML/XML.
Capability inventory: The presence of a command execution tool (prompt_tester.py) in the same collection increases the potential risk if an agent is tricked into using it for exploitation.
Sanitization: No significant sanitization or filtering of the fetched content is performed before processing.
[DYNAMIC_EXECUTION]: The prompt_tester.py script dynamically assembles and executes shell commands.
The run_runner function uses runner_cmd.format(prompt=prompt, input=case_input) to build a command string at runtime, which is then split and executed.

marketing-skills