The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it is designed to ingest and analyze untrusted data from external websites.
Ingestion points: The agent reads website DOM content, /llms.txt, and blog posts from arbitrary user-provided or crawled URLs.
Boundary markers: There are no explicit delimiters or "ignore embedded instructions" warnings used to separate the external content from the agent's internal logic.
Capability inventory: The agent can execute a local Python script (extract_links.py), perform browser automation using chrome-devtools or playwright, and access the network to fetch data.
Sanitization: There is no evidence of filtering or sanitization of the external content before it is processed in the agent's context.
[COMMAND_EXECUTION]: The skill invokes a local script scripts/extract_links.py to map website architecture. This script uses urllib.request.urlopen on a user-provided URL without validating the protocol, which could potentially be abused to read local files if the agent is directed to use a file:// scheme.
[EXTERNAL_DOWNLOADS]: The skill references external browser automation tools and MCP servers located at https://github.com/ChromeDevTools/chrome-devtools-mcp (a well-known service) and https://github.com/pasky/chrome-cdp-skill.

position-me