The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill is designed to read and verify high-value authentication data, specifically the SUBSTACK_SESSION_TOKEN, stored in a local environment file located at ~/.secrets/substack.env.
[COMMAND_EXECUTION]: The instructions direct the agent to execute bash shell commands, using grep to inspect the internal content of a local secrets file during configuration checks.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources, creating a potential attack surface for indirect prompt injection.
Ingestion points: The agent retrieves external content such as post drafts and user comments through tools like substack-get_draft, substack-get_reader_post, and substack-get_post_comments (SKILL.md).
Boundary markers: There are no explicit delimiters or instructions defined to treat these external inputs strictly as data, which could lead the model to follow instructions embedded in comments or drafts.
Capability inventory: The skill possesses significant capabilities, including shell access (bash, exec) and the ability to perform network writes and publication via substack-create_draft_post and substack-publish_draft (SKILL.md).
Sanitization: The skill does not describe any sanitization or validation steps for content fetched from the Substack API before it is processed by the agent.

substack-publish