The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted data from social media platforms (Xiaohongshu and Douyin). This represents an attack surface where malicious users could embed instructions in post content. The skill mitigates this through a specific "Hard Rule" (Rule 5 in SKILL.md) that explicitly forbids the agent from following any instructions found within the scraped materials. Ingestion occurs in read-list.md and read-one.md, while the capabilities used include browser automation and file writing.
[EXTERNAL_DOWNLOADS]: Setup instructions in setup.md direct the user to install the OpenCLI tool from an external source (npm or official website) and a Chrome extension. These third-party dependencies are required for the skill's functionality.
[COMMAND_EXECUTION]: The skill relies on executing system commands through gate.sh (macOS/Linux) and gate.ps1 (Windows). These scripts serve as a security boundary by enforcing rate limits (45–60 second intervals), restricting execution to a specific allowlist of subcommands, and maintaining a daily request cap of 80.
[PERSISTENCE]: The skill requests permission to create persistent scheduled tasks via launchd or Windows Task Scheduler to facilitate daily reports. This functionality is documented and requires explicit user consent during the setup phase.
[DYNAMIC_EXECUTION]: The skill generates and executes dynamic JavaScript snippets in the browser via opencli eval. This is restricted to local files in the js/ directory, and the gatekeeper scripts include sanitization checks to ensure that arguments passed into these scripts are strictly numeric.

star-content-agent