The Agent Skills Directory

[PROMPT_INJECTION]: The skill uses imperative, high-pressure language ("CRITICAL", "MANDATORY", "FAILURE... IS NOT ACCEPTABLE") to override the agent's default behavior, forcing it to perform disk operations immediately rather than at the end of a task.
[PERSISTENCE]: The skill mandates the creation and immediate update of local configuration and log files (.sb-pentest-context.json, .sb-pentest-audit.log, and the .sb-pentest-evidence/ directory). This ensures that extracted data remains in the environment across sessions, which can be used to store harvested information outside the agent's standard memory.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content (HTML, JavaScript, configuration files) to extract URLs and subsequently performs "reachability checks" (network requests) against them. This creates a surface for Server-Side Request Forgery (SSRF) if an attacker can control the "Supabase URL" found in the source code to point to internal services or metadata endpoints.
Ingestion points: Reads content from target URLs and local source directories (./dist/assets/).
Boundary markers: None provided; the skill directly processes the data for extraction.
Capability inventory: Performs network requests (REST API reachability) and file system writes.
Sanitization: No validation of the extracted URL's destination (internal vs external) beyond a "format check."
[DATA_EXFILTRATION]: The skill instructs the agent to search for and extract information from sensitive locations like environment variables (process.env, import.meta.env) and then write this data to a structured JSON file on the local disk, facilitating the collection of environment configuration.

supabase-extract-url