The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill uses npx defuddle in SKILL.md and uv run --script in scripts/fetch_zhihu.py and scripts/html-select.py. Both mechanisms download and execute code from remote registries (npm and PyPI) at runtime without pinning versions, which introduces a dependency on the integrity of those packages and registries.
[COMMAND_EXECUTION]: The skill executes various system-level CLI tools and local scripts to process content. Evidence includes:
Execution of curl, gh, yt-dlp, instaloader, and npx in SKILL.md.
Execution of specialized Python scripts: scripts/fetch_zhihu.py, scripts/html-select.py, and scripts/html-unescape.py.
The fetch_zhihu.py script attempts to locate and launch local Chromium binaries (/usr/bin/chromium, google-chrome, etc.) and modifies browser behavior via stealth scripts.
[EXTERNAL_DOWNLOADS]: The skill makes extensive network requests to a wide variety of external domains and APIs (Twitter/fxtwitter, Bilibili, YouTube, Reddit, StackExchange, etc.) to fetch data. While these are mostly well-known services, the skill communicates with them to retrieve untrusted content.
[PROMPT_INJECTION]: The skill is highly vulnerable to Indirect Prompt Injection (Category 8) because its primary function is to ingest untrusted web content and provide it to the agent as markdown.
Ingestion points: Web content fetched via curl, defuddle, and specialized site scrapers.
Boundary markers: Absent. The instructions do not specify delimiters or provide warnings to the agent to ignore instructions embedded in the retrieved markdown.
Capability inventory: The agent context typically includes subprocess execution and file system access.
Sanitization: Content is cleaned for readability (converting HTML to Markdown), but no security-focused sanitization or filtering of malicious prompt instructions is performed.

read-url