The Agent Skills Directory

[EXTERNAL_DOWNLOADS] (HIGH): The skill is designed to download content from any user-provided URL. This facilitates the ingestion of untrusted data directly into the agent's working environment.
[PROMPT_INJECTION] (HIGH): The skill is highly vulnerable to Indirect Prompt Injection.
Ingestion points: Data is fetched from untrusted external URLs (specified in SKILL.md).
Boundary markers: None. Content is written directly to the filesystem without isolation or 'ignore' instructions.
Capability inventory: File system write access (out argument) and unrestricted network access.
Sanitization: No sanitization logic is described or present in the metadata to filter malicious instructions within fetched data.
[DATA_EXFILTRATION] (HIGH): Given that the skill is intended to send data to URLs and the documentation mentions handling 'Confidential' and 'Personal' knowledge, there is a severe risk of the agent being coerced into exfiltrating local secrets to an attacker-controlled endpoint.
[NO_CODE] (MEDIUM): The critical logic file scripts/collect.cjs and the referenced codebase-mapper/scripts/map.cjs are missing, preventing a full audit of how parameters like url and out are sanitized before execution.
[CREDENTIALS_UNSAFE] (MEDIUM): The SKILL.md file explicitly references a 'Knowledge Protocol' for managing confidential/personal secrets, which significantly increases the impact of any prompt injection or exfiltration vulnerability.

data-collector