The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes Markdown articles from local file paths, which presents a surface for indirect prompt injection if source files contain malicious instructions.
Ingestion points: lib/content-loader.mjs reads data from user-specified local files.
Boundary markers: There are no explicit delimiters or system instructions to distinguish article content from potential agent-directed commands.
Capability inventory: The skill possesses the ability to make network POST requests to the note.com API and perform automated browser interactions via Playwright.
Sanitization: lib/markdown-converter.mjs uses remark-html with the sanitize option set to false, though it does implement custom logic to strip MDX imports and JSX tags.
[DATA_EXFILTRATION]: The skill manages authentication tokens by persisting session cookies in the user's home directory (~/.config/note-md-publisher/cookies.json).
This mechanism allows for persistent sessions on note.com without re-authenticating for every task.
Security is maintained by strictly setting file permissions to 0600 in lib/auth.mjs, preventing access by other local users.
The data is only transmitted to the legitimate note.com service during authenticated requests, which is the intended purpose of the skill.

note-automation