The Agent Skills Directory

[DATA_EXFILTRATION] (LOW): The skill performs network requests using curl to external domains mcp.domaindetails.com, api.domaindetails.com, and api.semrush.com which are not on the trusted sources list. These requests transmit user-provided domain names to third-party services.
[EXTERNAL_DOWNLOADS] (LOW): The skill downloads and processes data from external APIs. While it uses jq for parsing rather than executing the content as code, it relies on the availability and integrity of these non-whitelisted remote endpoints.
[CREDENTIALS_UNSAFE] (INFO): The skill utilizes ${SEMRUSH_API_KEY} within a URL query string. While this is an environment variable placeholder and not a hardcoded secret, passing API keys in URLs is a suboptimal security practice as they can be captured in server logs or proxy history.
[PROMPT_INJECTION] (LOW): Detected an Indirect Prompt Injection surface (Category 8).
Ingestion points: Data retrieved from domaindetails.com, api.semrush.com, and archive.org is ingested into the agent context.
Boundary markers: Absent. The output from curl commands is processed via jq and formatted into markdown without explicit delimiters or instructions for the agent to ignore embedded commands in the fetched data.
Capability inventory: The skill has network access (curl) and JSON processing capabilities (jq). It does not appear to have file-write or arbitrary code execution capabilities.
Sanitization: No evidence of sanitization or validation of the content returned from external APIs before it is presented to the agent.

domain-research