The Agent Skills Directory

[COMMAND_EXECUTION]: The file references/checks.md defines several shell command pipelines using curl, grep, sed, and python3. These commands utilize variables like $URL and $SITE, which are expected to be populated by the agent. If these variables contain shell metacharacters, it could lead to command injection within the execution environment.
[EXTERNAL_DOWNLOADS]: The skill uses curl to fetch content from remote websites based on user-supplied or agent-identified URLs. This involves interacting with untrusted external servers to retrieve HTML and JSON-LD data.
[PROMPT_INJECTION]: The skill processes content from untrusted external websites, which presents an attack surface for indirect prompt injection.
Ingestion points: Raw HTML and JSON-LD data are ingested via curl in references/checks.md and passed to subsequent processing steps.
Boundary markers: There are no explicit delimiters or instructions provided to the processing tools (grep, python) to ignore or isolate potentially malicious instructions embedded within the fetched website content.
Capability inventory: The skill uses python3 to execute logic for HTML stripping and JSON filtering, and grep for text matching, all of which operate on the untrusted data.
Sanitization: The skill does not perform sanitization or validation of the content retrieved from external URLs before processing it through the command pipeline.

citation-readiness-audit