The Agent Skills Directory

[DYNAMIC_EXECUTION]: The scripts/sync_flow.py file uses importlib.util to dynamically load and execute a Python script (sync_flow.py) from a computed path. While it targets a 'scripts' directory intended for core implementations, loading executable code from paths derived at runtime is a risk factor.
Evidence: scripts/sync_flow.py resolves a path using Path(__file__).resolve().parents[3] / "scripts" or an environment variable and calls spec.loader.exec_module(module).
[EXTERNAL_DOWNLOADS]: The /blog flow sync command is designed to pull prompt files from the author's GitHub repository (github.com/AgriciDaniel/flow) and write them to a local persistent directory. This is a functional requirement for the sync feature.
Evidence: SKILL.md describes the /blog flow sync command as performing network writes from the GitHub API into a persistent references root.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-provided topics or URLs by applying a library of SEO-focused prompts. This creates an attack surface where an adversary-controlled webpage (the target URL) could contain hidden instructions to manipulate the agent's behavior during the 'Optimize' or 'Win' stages.
Ingestion points: User-supplied [topic|url] arguments processed by commands in SKILL.md.
Boundary markers: The prompt templates in references/prompts/ (e.g., basic-prompt.md) contain instructions to "Use only supplied evidence" and "Label assumptions," which act as weak boundaries.
Capability inventory: The agent has capabilities for network access and file writing (via the sync command), and file reading (via the reference library).
Sanitization: There is no evidence of automated sanitization or escaping of the content retrieved from the user-provided URLs before it is processed by the LLM.

blog-flow