The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by fetching and processing untrusted data from external sources.
Ingestion points: The skill fetches external data using webfetch for /sitemap.xml, /robots.txt, and various web page URLs provided by the user or discovered during a crawl.
Boundary markers: The instructions lack explicit boundary markers or delimiters (e.g., XML/Markdown tags) to separate untrusted external content from the agent's instructions, nor do they include warnings to ignore embedded instructions in the fetched data.
Capability inventory: The skill has the capability to write files to the local disk (sitemap.xml and various .md report files) and execute a Python script (scripts/report_publish.py) via the command line.
Sanitization: There is no mention of sanitizing or escaping the content retrieved from external URLs before it is incorporated into reports or processed by the agent; the "Clean the URL set" step focus solely on HTTP status codes and canonicalization rather than security sanitization.
[COMMAND_EXECUTION]: The skill instructs the agent to execute a specific command-line tool: python scripts/report_publish.py <report>.md. While this appears to be a legitimate part of the report generation workflow, the execution of scripts on files derived from potentially untrusted external data presents a potential risk if the script or the agent's handling of the filename/content is not secure.

sitemap-builder