The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses string interpolation to construct shell commands incorporating user-supplied variables.
Evidence: python scripts/dfs_client.py ranked --target "<user-domain>" and python scripts/dfs_client.py ideas --keyword "<top seed>" in SKILL.md.
Risk: If the execution environment does not adequately sanitize these parameters, malicious inputs containing shell metacharacters could lead to arbitrary command execution.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes live data from external search engine result pages (SERPs) which are under the control of third parties.
Ingestion points: Data is pulled from external sources via scripts/dfs_client.py.
Boundary markers: The instructions lack explicit delimiters or warnings to ignore instructions embedded within the retrieved SERP data.
Capability inventory: The skill performs file writes (CONTENT-OPPORTUNITIES-...) and executes several local Python scripts.
Sanitization: There is no mention of sanitizing or filtering the external content before it is processed by the agent or included in reports.
[EXTERNAL_DOWNLOADS]: The skill fetches live ranking and keyword data from DataForSEO's infrastructure.
Evidence: References to dfs_client.py and the DATAFORSEO-SETUP.md documentation.
Note: This is a standard operation for the skill's primary purpose of SEO analysis using a well-known service provider.

content-opportunity-finder