The Agent Skills Directory

EXTERNAL_DOWNLOADS (LOW): The skill uses curl to communicate with https://bm.md. This domain is not categorized as a trusted source, although the communication is required for the tool's functionality.\n- DATA_EXFILTRATION (LOW): User-provided Markdown or HTML is sent to the external bm.md service. No sensitive local data access (e.g., SSH keys, environment variables) was detected.\n- PROMPT_INJECTION (LOW): The skill processes untrusted input strings (Markdown/HTML), which presents an indirect prompt injection surface. Maliciously crafted input could potentially attempt to influence the agent's logic if the output is processed further.\n
Ingestion points: Input parameters markdown and html in tools defined in SKILL.md.\n
Boundary markers: None used to delimit untrusted input.\n
Capability inventory: Network requests to external API via curl.\n
Sanitization: No input sanitization or validation logic is defined within the skill.

bm-md