The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The documentation file reference/european-company-data-institutions.md contains a reference to https://www.eubusinessregister.org/. This domain is blacklisted by security scanners as malicious. The file itself was flagged by antivirus scanners as suspicious due to the inclusion of this URL.
[COMMAND_EXECUTION]: Scripts in reference/scripts/ for Romania (RO), Germany (DE), and the United Kingdom (UK) utilize subprocess.run() to invoke the mcpc CLI tool. This is used to trigger Apify actors for data scraping and financial filing retrieval.
[DATA_EXFILTRATION]: The skill transmits company identifiers (IČO, KRS, NIP, CUI, LEI) and search keywords to multiple third-party government registries and the Apify platform. While necessary for the skill's purpose, this involves sending user-provided data to external endpoints.
[PROMPT_INJECTION]: The skill is subject to Indirect Prompt Injection risks because it retrieves and processes data from various external registries and web pages.
Ingestion points: Data is fetched from numerous REST/SOAP APIs and scraped from websites like orsr.sk and finstat.sk using scripts in the reference/scripts/ directory.
Boundary markers: No explicit delimiters or instructions are used to separate external data from the agent's instructions during interpolation into the context.
Capability inventory: The skill possesses the capability to execute shell commands via subprocess.run() to interact with the mcpc utility.
Sanitization: While scripts use JSON parsing and regular expressions for data extraction, there is no evidence of content sanitization to prevent malicious instructions embedded in registry data from affecting agent behavior.

apify-public-registries