The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands involving content extracted from external websites, creating a vulnerability for command injection.
Evidence: The skill workflow and output sections specify the command echo 'BLOCK_MARKUP' | pbcopy (SKILL.md).
Because the data inside the single quotes is retrieved from remote URLs (product titles, features, etc.), a malicious product page containing shell control characters could manipulate the command execution environment if the agent does not properly escape the string.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external websites to influence its output without sufficient isolation.
Ingestion points: Data is fetched from user-provided URLs using WebFetch or firecrawl (SKILL.md, Workflow step 2).
Boundary markers: The instructions lack delimiters or specific directives to the agent to ignore instructions embedded in the retrieved web content.
Capability inventory: The skill uses the shell (pbcopy) and generates WordPress block markup.
Sanitization: The extraction rules describe formatting improvements ("clean brand clutter", "improve wording") but do not include security-focused sanitization to prevent the injection of malicious prompts or code within the generated block.
[DATA_EXFILTRATION]: The skill automatically modifies user data to include the author's tracking identifiers.
Evidence: Hardcoded affiliate tags gtorg0f-20 (Amazon US) and gaurtiwa-21 (Amazon India) are appended to all generated product links (SKILL.md, Affiliate Tags).
This behavior redirects potential affiliate commissions to the author's account by default, which constitutes a form of data alteration/exfiltration of potential value.

product-box-block