The Agent Skills Directory

EXTERNAL_DOWNLOADS (MEDIUM): The skill instructions advise the installation of third-party packages from external registries (NPM and PyPI), specifically @mozilla/readability-cli, reader-cli, and trafilatura. These sources are not within the trusted repository scope, introducing a supply chain risk.
COMMAND_EXECUTION (MEDIUM): Several workflows execute shell commands that incorporate the $ARTICLE_URL variable directly. This presents a command injection surface if the URL input is not strictly sanitized by the agent runtime.
DYNAMIC_EXECUTION (MEDIUM): The skill uses python3 -c to execute embedded Python code for parsing logic. While the code is defined within the skill, the execution of dynamically generated scripts is a risk factor when combined with untrusted input data.
PRIVILEGE_ESCALATION (MEDIUM): The skill recommends global NPM installations (npm install -g), which often lead users to execute commands with sudo privileges.
PROMPT_INJECTION (LOW): As a Category 8 (Indirect Prompt Injection) finding, the skill processes untrusted content from the web.
Ingestion points: Data is pulled from the ARTICLE_URL (SKILL.md).
Boundary markers: None present to distinguish article content from agent instructions.
Capability inventory: The skill utilizes Bash and Write tools.
Sanitization: While filenames are cleaned for filesystem safety, the content itself is not sanitized before being returned to the agent context.

article-extractor