The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill recommends using defuddle.md, an external third-party service, to fetch and convert web pages. This establishes a dependency on an unverified external source and involves downloading data from a remote server for processing.
[COMMAND_EXECUTION]: The documentation provides a shell command (curl -sL https://defuddle.md/) for the agent to execute, enabling automated network requests and data retrieval within the agent environment.
[DATA_EXFILTRATION]: As explicitly noted in the skill's documentation, using the third-party extraction service sends URL requests to an external entity, potentially exposing sensitive URLs or internal engagement metadata to the service operator.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection via content fetched from arbitrary external URLs. Ingestion points: External advisory content fetched via curl from defuddle.md (SKILL.md); Boundary markers: Absent; there are no instructions to use delimiters or treat the fetched text as untrusted; Capability inventory: The agent uses this data to prioritize vulnerabilities and influence remediation decisions (SKILL.md); Sanitization: Absent; no filtering or validation of the remote content is specified.
[PROMPT_INJECTION]: The metadata field 'verified' contains a future date (2026-07-27), which constitutes deceptive metadata.

managing-vulnerabilities