The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/new_scraper.py functions as a code generator. It takes a user-provided name and URL, substitutes them into a predefined Python template, and writes the resulting code to a new .py file on the local filesystem. It then modifies the file permissions using chmod 0o755 to make the generated script executable. While this is a common developer utility pattern, it involves runtime creation and permission elevation of executable content.
[INDIRECT_PROMPT_INJECTION]: The skill's primary purpose is to fetch and process data from external, untrusted websites. This creates an attack surface for indirect prompt injection, where malicious instructions embedded in the HTML of a target site could influence the agent's behavior during the scraping or review process. 1. Ingestion points: Untrusted data enters the context via requests.get() and urllib.request.urlopen() calls in examples/after.md, examples/before.md, and scripts/new_scraper.py. 2. Boundary markers: No explicit delimiters or instructions are used to treat the scraped HTML as untrusted data that should not be followed as instructions. 3. Capability inventory: The skill has the capability to write to the local filesystem (CSV results and Python scripts) and interact with the user. 4. Sanitization: While the content is parsed via BeautifulSoup to extract specific tags, there is no validation or filtering to prevent natural language instructions from reaching the underlying model.

web-scraping-python