The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses curl, grep, and sed via the references/checks.md file to perform site reconnaissance and validation. These commands are used to fetch public HTTP status codes, check content-types, and extract public URLs from sitemaps and HTML tags (e.g., curl -s "$SITE/sitemap.xml" | grep -oE '<loc>[^<]+</loc>'). This is standard behavior for a site auditing tool.
[DATA_EXPOSURE_AND_EXFILTRATION]: No sensitive file paths (like .ssh or .aws) are accessed. The skill explicitly includes a references/guardrails.md file that instructs the agent not to recommend or expose private, authenticated, or sensitive paths (e.g., admin, staging, checkout, or account pages).
[INDIRECT_PROMPT_INJECTION]: The skill processes external data (website content, sitemaps). It manages this risk by using specific commands to extract only structured data (like status codes and URL locations) rather than executing or interpreting the full content as instructions. The mandatory evidence chain for this category is as follows:
Ingestion points: External websites defined by the $SITE variable, including robots.txt, sitemap.xml, and HTML source code.
Boundary markers: The instructions use specific extraction patterns (regex) rather than broad 'summarize everything' prompts.
Capability inventory: Uses curl, grep, sed, and bash loops to check status codes.
Sanitization: None observed beyond regex filtering, but the risk is mitigated by the factual, technical nature of the task (drafting a markdown file).

llms-txt-generator