The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to fetch content from arbitrary external URLs using crawlberg scrape <url> and convert it into Markdown for LLM context. This creates a significant surface for indirect prompt injection where a malicious website could include hidden instructions designed to hijack the agent's behavior.
Ingestion points: The crawlberg scrape command in SKILL.md fetches data from user-supplied or attacker-controlled URLs.
Boundary markers: There are no explicit instructions or delimiters mentioned to isolate the scraped content from the agent's primary instructions.
Capability inventory: The skill uses a CLI tool capable of network requests, proxying (--proxy), and piping output to the filesystem (e.g., > /tmp/article.md).
Sanitization: The documentation describes "cleaning" HTML to Markdown, but this is a structural transformation, not a security sanitization against prompt injection attacks.
[COMMAND_EXECUTION]: The skill relies on the execution of the crawlberg CLI tool. It documents various flags such as --browser-endpoint for connecting to external Chrome DevTools Protocol (CDP) instances and --config for passing inline JSON or file-based configurations, which could be misused if input is not strictly validated.
[DATA_EXFILTRATION]: The tool includes features for proxy support (--proxy) and custom user-agents (--user-agent). While these are standard scraping features, they could be used to facilitate data exfiltration or to bypass network restrictions in a compromised environment.

scraping-html-to-markdown