The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes untrusted third-party content from Xiaohongshu notes, which could contain malicious instructions designed to influence the agent's behavior.
Ingestion points: Data is ingested via extract-search-feeds.py (which extracts note titles) and extract-note-detail.py (which extracts the full body text/description).
Boundary markers: The instructions do not define clear delimiters or include warnings for the agent to ignore instructions embedded within the extracted note content.
Capability inventory: The skill utilizes browser-act for navigation and DOM evaluation. It does not have capabilities for file system modification or outbound network requests beyond the target platform.
Sanitization: While the scripts use json.dumps to sanitize input parameters for JavaScript execution, the extracted content itself is not sanitized or filtered for prompt injection patterns before being returned to the agent context.
[COMMAND_EXECUTION]: The skill executes local Python scripts (extract-search-feeds.py and extract-note-detail.py) to generate JavaScript payloads. These payloads are then executed in the browser context via browser-act eval --stdin. This is a standard implementation for data extraction skills and uses static templates with proper escaping for parameters, representing a low-risk use of dynamic execution.

xiaohongshu-search-full