The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the user-provided $ARGUMENTS directly in shell commands such as mkdir -p {site_path}/{data_type}/pages and cp. Maliciously crafted input strings could potentially lead to command injection if the environment does not provide sufficient isolation or sanitization.
[COMMAND_EXECUTION]: The skill executes local Python scripts using uv run from a directory structure outside the immediate skill folder (e.g., ${CLAUDE_SKILL_DIR}/../scrape-explore-site/scripts/). This reliance on external relative paths increases the attack surface if the surrounding directory environment is compromised.
[EXTERNAL_DOWNLOADS]: The skill triggers scraping of arbitrary remote URLs provided in input specifications via the /scrape-explore-site sub-agent. While this is the intended purpose, it involves making network requests to third-party domains.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection by processing untrusted data from scraped files and incorporating it into prompts for subsequent agent tasks.
Ingestion points: Reads site specifications and page analysis results from {site_path}/spec.json and .scrape/.work/{site_name}/analyze-page/.
Boundary markers: Absent; the instructions do not use delimiters or provide warnings to the agent to ignore instructions embedded within the data being processed.
Capability inventory: The skill has access to Bash for file and command execution, and can invoke other Agent and Skill components.
Sanitization: Absent; there is no evidence of filtering or escaping content from external files before it is used to influence the workflow.

scrape-spec