The Agent Skills Directory

[EXTERNAL_DOWNLOADS] (SAFE): The skill uses standard, widely-used Python packages (requests, beautifulsoup4, click). These are installed via standard package managers and no remote script execution (e.g., piping curl to bash) is present.
[DATA_EXFILTRATION] (LOW): The script performs network operations (requests.get and requests.head) to non-whitelisted domains provided by the user. While this is necessary for the skill's primary purpose (link checking), it constitutes a network surface for potential data exfiltration if combined with unauthorized data access (though no such access was found in this skill).
[PROMPT_INJECTION] (LOW): Indirect Prompt Injection Surface. The skill fetches and parses HTML content from external, untrusted websites which could contain malicious instructions designed to influence the agent's behavior.
Ingestion points: Content is fetched from arbitrary URLs in scripts/main.py via the get_links function.
Boundary markers: Absent; the skill does not use delimiters or warnings to isolate external link data from the agent's primary instructions.
Capability inventory: The script has network access (requests) and file-writing capabilities (open for CSV output).
Sanitization: Absent; the script extracts raw href attributes without sanitizing the strings for potential injection patterns.

link-checker