mlava/agent-ready-api
Use the Agent Ready (agent-ready.dev) REST API to scan any public URL for AI agent-readability against the Vercel Agent Readability Spec, the llmstxt.org standard, and agent-protocol manifests (MCP server cards, A2A, agents.json, agent-permissions.json, UCP, x402, NLWeb). Activates for "scan this site for AI agent-readability", "run an Agent Ready scan on {URL}", "check the Agent Ready score for {URL}", "what's the agent-readability rating for {URL}", or any time the user wants a programmatic readability scan via HTTP. Picks this skill when the user does NOT have the Agent Ready MCP server installed — for MCP, use the `agent-ready-mcp` skill instead.
74
93%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Low
Low-risk findings worth noting
Low
Low-risk findings.
1 low severity finding. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
In SKILL.md Step 2-3, the workflow accepts a user-provided `url` in `POST https://agent-ready.dev/api/v1/scans` and then ingests the scan results from `GET https://agent-ready.dev/api/v1/scans/{id}`, which include scraped outsider-authored text from that URL.
Where we found it
agent-ready.dev
domain · 4 sites
The plugin POSTs a user-provided URL to agent-ready.dev/api/v1/scans, then GETs the scan results which contain scraped outsider-authored text (titles, headings, llms.txt bodies, check messages) from the target site, creating an indirect prompt-injection vector.
SKILL.md
64
curl -X POST https://agent-ready.dev/api/v1/scans \
SKILL.md
89
curl https://agent-ready.dev/api/v1/scans/$SCAN_ID \
SKILL.md
97
result=$(curl -s https://agent-ready.dev/api/v1/scans/$SCAN_ID \
SKILL.md
140
curl -X POST https://agent-ready.dev/api/v1/ask \
- Audited
- Security analysis