The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill requires environment variables for authentication (WORDSTAT_API_KEY, WORDSTAT_FOLDER_ID). This is a secure and recommended practice that avoids hardcoding sensitive credentials directly in the source code or configuration files.
[EXTERNAL_DOWNLOADS]: The installation command npx hermes skill install axelfreeman/yandex-wordstat-guide downloads the skill from the author's repository. This represents a standard deployment method for the skill's intended ecosystem and is considered safe when originating from the verified author.
[INDIRECT_PROMPT_INJECTION]: The skill retrieves and processes external search query data from Yandex, which is then used to influence agent outputs such as SEO content and advertising strategies.
Ingestion points: User-provided search themes and keyword statistics retrieved from the Yandex Wordstat API (e.g., semantic_results.json).
Boundary markers: The instructions do not provide explicit delimiters or instructions to the agent to disregard potential control characters or malicious instructions embedded within the retrieved search data.
Capability inventory: The skill utilizes a Python script (scripts/collect.py) to process the search data, which is executed via a shell command.
Sanitization: There is no evidence of input validation or sanitization for the search phrases before they are processed by the script or presented to the agent.

wordstat-collector