The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell commands including curl, jq, sed, and tee. It implements input validation for the SECSKILL_CVE_ID variable using a regular expression to ensure the ID follows the standard CVE format before processing.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from an external API, which could theoretically contain malicious instructions targeting the agent.
Ingestion points: Data is fetched from services.nvd.nist.gov using curl and stored in a local JSON file.
Boundary markers: The skill does not use specific delimiters or instructions to the agent to disregard embedded commands within the fetched vulnerability descriptions.
Capability inventory: The workflow utilizes shell command execution and file writing capabilities across several steps in SKILL.md.
Sanitization: The skill uses jq to extract structured data and head to truncate output, providing some structure, but it does not perform safety-specific sanitization of the natural language descriptions fetched from the API.

cve-lookup