The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses shell commands to invoke local Python scripts (seo_lint.py, dfs_client.py, report_publish.py) by interpolating user-supplied variables such as <page> and <keyword>.
Evidence in SKILL.md: python scripts/seo_lint.py --url <page> --category cro --format text and python scripts/dfs_client.py serp --keyword "<page's main keyword>" --limit 10.
Lack of input sanitization or validation in the instructions could allow an attacker to provide a malicious URL or keyword containing shell metacharacters (e.g., ;, &&, |) to execute arbitrary commands on the underlying system.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to fetch and analyze content from external, untrusted sources including user-provided landing pages and competitor websites found in Search Engine Results Pages (SERP).
Ingestion points: External data is ingested in Step 1 (page audit), Step 3 (competitor benchmarking), and Step 4 (objection mining) within SKILL.md.
Boundary markers: Absent. The instructions do not define specific delimiters or provide the agent with "ignore embedded instructions" warnings for the external content being processed.
Capability inventory: The skill has the capability to write files to the system via report_publish.py and access environment variables (SEO_REPORTS_DIR).
Sanitization: Absent. Content mined from competitor FAQs and reviews is directly incorporated into the audit findings and experiment plans without filtering for malicious prompt instructions.

cro-audit