The Agent Skills Directory

[PROMPT_INJECTION]: Indirect Prompt Injection vulnerability surface identified in article data processing.
Ingestion points: scripts/csdn.py fetches article titles, stats, and metadata from CSDN APIs via cmd_articles and cmd_article commands.
Boundary markers: Absent. Data from CSDN is interpolated directly into the agent context without delimiters or instructions to ignore embedded commands.
Capability inventory: Subprocess execution via Bash tool, file writing capabilities, and network operations for publishing articles and re-hosting images.
Sanitization: No validation or sanitization of external article metadata before processing.
[CREDENTIALS_UNSAFE]: The skill processes sensitive authentication data.
Session Access: Accesses the CSDN_COOKIES environment variable to authenticate with CSDN services.
Hardcoded Keys: Hardcoded HMAC keys (CA_KEY, CA_SECRET) are present in scripts/csdn.py. These are documented as public keys from CSDN's own web implementation and are vendor-owned.
[EXTERNAL_DOWNLOADS]: The rehost_images feature performs network requests to fetch images from arbitrary external URLs found in Markdown input.
Mitigation: Includes an SSRF guard (_assert_public_url) that validates hostnames and IPs against private/reserved ranges and a custom redirect handler to prevent unexpected network traversals.
[DATA_EXFILTRATION]: Secure cookie handling practices are implemented to prevent accidental leakage.
Mitigation: Uses add_unredirected_header for session cookies, ensuring that sensitive headers are not forwarded by the HTTP client during redirects to different hosts.

csdn