The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The file commands.md references the URL https://short.link/abc, which has been explicitly identified as malicious and blacklisted by security scanners. While used as an example, referencing known malicious domains is a safety violation.
[PROMPT_INJECTION]: The skill is highly vulnerable to indirect prompt injection through its automated web browsing and extraction features. Ingestion points: Untrusted HTML content enters the agent's context via the cd <url>, crawl, and prefetch commands (documented in SKILL.md and commands.md). Boundary markers: The extraction prompt used by the haiku subagent in state/cache.md lacks delimiters (such as triple quotes or separator lines) and contains no instructions to ignore or isolate commands found within the source HTML. Capability inventory: The agent possesses extensive capabilities, including writing to the local filesystem, executing shell commands for workspace initialization, and spawning further subagents with network access (shell.md, state/cache.md). Sanitization: There is no evidence of HTML sanitization or filtering of fetched content before it is passed to the extraction engine.
[CREDENTIALS_UNSAFE]: The login command in commands.md and the environment management logic in shell.md are designed to handle and store sensitive authentication data, including session cookies (COOKIE_*) and authorization headers (HEADER_Authorization). These secrets are stored in plain text within the user's working directory (.websh/session.md).
[COMMAND_EXECUTION]: The workspace initialization logic in shell.md utilizes the Bash tool to execute system-level commands like mkdir -p to set up its directory structure.

websh