The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-generated content from external sources (Xiaohongshu) and presents it to the agent, creating a potential vector for malicious instructions to influence agent behavior.
Ingestion points: Data is fetched from the Xiaohongshu Web API via xhs_client.py through functions like navigate_search_page, navigate_note_page, and navigate_user_posted.
Boundary markers: The skill does not implement explicit delimiters or warnings to instruct the agent to ignore instructions embedded within the fetched note titles, descriptions, or comments.
Capability inventory: The skill possesses the capability to publish posts through xhs_publish.py, which could be abused if an agent follows malicious instructions found in ingested content (a read-then-write loop).
Sanitization: There is no evidence of filtering, escaping, or sanitizing external content before it is formatted and returned to the agent's context.
[COMMAND_EXECUTION]: The skill's operational instructions in SKILL.md and README.md rely on the execution of local shell commands.
Evidence: Instructions include running pip install, playwright install, and multiple invocations of xhs.py and xhs_publish.py with various arguments to manage account state and perform actions.

xhs-cli