The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions involve using standard command-line utilities such as curl to retrieve web page source code and suggest the use of Lighthouse CLI for performance analysis. These are legitimate tools for the task.
[PROMPT_INJECTION]: As a tool designed to ingest and analyze external web content, this skill naturally presents a surface for indirect prompt injection. 1. Ingestion points: External URLs fetched via curl in SKILL.md. 2. Boundary markers: The instructions do not define specific delimiters for the fetched content. 3. Capability inventory: The skill utilizes network fetching and identifies command-line analysis tools. 4. Sanitization: There are no instructions for sanitizing or escaping the retrieved HTML. This is an expected risk factor for web-auditing functionality and is not considered a malicious finding.

technical-audit