The Agent Skills Directory

[COMMAND_EXECUTION]: The Preamble in SKILL.md contains bash scripts that are intended to run automatically when the skill is initialized. This provides a mechanism for executing arbitrary code on the host machine.
[REMOTE_CODE_EXECUTION]: The telemetry scripts (telemetry/version_check.py and telemetry/telemetry_init.py) referenced in the SKILL.md preamble are not included in the skill's source files. Executing logic from external, missing files is a security risk as the behavior of these scripts cannot be verified or audited.
[EXTERNAL_DOWNLOADS]: The skill uses the requests library in podcast_pipeline.py to download audio files from user-supplied RSS feed URLs. While necessary for the skill's function, downloading from arbitrary sources presents a risk of processing malicious payloads.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted podcast transcripts and interpolates them directly into prompts for the AI agent. Ingestion points: Audio is downloaded from RSS feeds and transcribed, or transcripts are read from local files in podcast_pipeline.py. Boundary markers: The skill does not use delimiters or instructions to ignore embedded commands when passing transcript text to the LLM in extract_content_atoms. Capability inventory: The skill has the ability to write files to the local output/ directory and make network requests to external APIs (OpenAI and Anthropic). Sanitization: There is no evidence of text sanitization or filtering to remove potential malicious instructions from the transcribed audio or input files before they are processed by the LLM.

podcast-ops