The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its core function of crawling and analyzing external websites, Google Search Console reports, and robots.txt files.
Ingestion points: Data fetched via curl from arbitrary website URLs, Google Suggest results, and GSC performance data.
Boundary markers: Absent; the skill does not provide specific instructions to the agent on how to differentiate between its own instructions and potentially malicious commands embedded in the processed SEO data.
Capability inventory: The agent has access to powerful tools including shell execution (curl, wrangler), file system modification, and web deployment capabilities.
Sanitization: No explicit validation or escaping of the fetched external content is defined before it is processed by the agent.
[PROMPT_INJECTION]: The skill implements a 'Self-Update Protocol' that instructs the agent to persist 'verified experiences' by editing the SKILL.md file itself. This creates a feedback loop where malicious content analyzed during an SEO task could potentially be inserted into the skill's permanent instruction set, leading to persistent poisoning of the agent's behavior.
[COMMAND_EXECUTION]: The skill utilizes shell commands to perform its duties, including fetching data from external APIs via curl and deploying web applications using the wrangler CLI. It also suggests writing .sh scripts to handle complex loops, which involves dynamic script generation and execution.
[EXTERNAL_DOWNLOADS]: Fetches data from external services including suggestqueries.google.com, googleapis.com, and seo.web.cafe to perform SEO analysis. These interactions are core to the skill's purpose but involve sending data (like keywords) to third-party domains.

rankup