The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The SKILL.md preamble contains shell commands that execute Python scripts (telemetry/version_check.py and telemetry/telemetry_init.py) when the skill starts. These files are missing from the skill package, preventing verification of their behavior.
[EXTERNAL_DOWNLOADS]: The scripts/editorial-brain.py script uses yt-dlp to download video and subtitle content from user-provided URLs. While functional for the skill's purpose, this involves processing untrusted external data through local command-line tools.
[COMMAND_EXECUTION]: Multiple scripts (content-quality-gate.py, editorial-brain.py) use subprocess.run to execute external binaries (yt-dlp, ffmpeg) or other Python scripts. This is generally used for legitimate processing but increases the attack surface.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data, including YouTube transcripts, RSS feeds, and user-provided content artifacts. This creates a surface for indirect prompt injection, where malicious instructions embedded in the source content could attempt to influence the agent's scoring or rewriting behavior.
Ingestion points: scripts/editorial-brain.py (YouTube VTT subtitles), scripts/quote-mining-engine.py (RSS feeds and meeting notes), and Step 1 of the main expert panel process in SKILL.md (arbitrary content/artifacts).
Boundary markers: The skill uses specific expert personas and rubrics (e.g., experts/humanizer.md) to evaluate content, which provides some structural separation but does not strictly isolate the processed data from the prompt logic.
Capability inventory: The agent has capabilities for network access (Anthropic API, RSS feeds), local file writes to the data directory, and subprocess execution (ffmpeg, yt-dlp).
Sanitization: Basic HTML stripping and VTT tag removal are performed, but no comprehensive sanitization of natural language instructions within the processed data is evident.

content-ops