The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process project-root files such as BRAND.md, VOICE.md, and DISCOURSE.md. These files are considered untrusted data as they may be authored by third parties.
Ingestion points: Project-root files are loaded into downstream agent prompts in SKILL.md (Auto-loaded Project-Root Context section).
Boundary markers: The skill implements a sophisticated defense using a fresh 128-bit hex nonce for each fenced block, as described in the 'Untrusted-Data Contract' (v1.8.0).
Capability inventory: The skill possesses significant capabilities including shell command execution (python3), file system modification (mkdir), and network operations (link validation in Gate 5).
Sanitization: The load_untrusted_root.py helper performs sanitization scans for instruction-shaped patterns like 'ignore previous' or 'bypass'.
[COMMAND_EXECUTION]: The orchestrator frequently executes local Python scripts (blog_preflight.py, blog_render.py, generate_hero.py, analyze_blog.py) to handle core logic such as quality scoring, rendering, and pre-flight checks. While these are part of the skill's intended functionality, they represent a significant execution surface.
[EXTERNAL_DOWNLOADS]: The skill fetches assets from various external sources.
It downloads images via official APIs for Pixabay, Unsplash, and Pexels.
It uses the Openverse public API (api.openverse.org) for Creative Commons assets when API keys are missing.
It validates external links in 'Gate 5' of the delivery contract, which involve DNS resolution and HTTP HEAD/GET requests.
[DYNAMIC_EXECUTION]: The skill utilizes patchright (a Playwright fork) and weasyprint for rendering HTML into PDF format at runtime. This involves running a headless browser and performing dynamic content generation.
[DATA_EXPOSURE]: The skill probes for the presence of sensitive environment variables like GOOGLE_AI_API_KEY, UNSPLASH_ACCESS_KEY, and GEMINI_API_KEY. Although the skill documentation states that values are never read or logged, checking for their existence is a form of metadata exposure.

blog