The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes two Bash scripts (audit-feed.sh and find-guidance.sh) used for content discovery and source verification. These scripts execute embedded, hardcoded Python code to process local reference data and external RSS feed metadata. The scripts are designed for offline search and metadata comparison, using temporary directories and clean-up traps, and do not perform any privileged or dangerous operations.
[EXTERNAL_DOWNLOADS]: The audit-feed.sh utility fetches an RSS feed from https://www.joshwcomeau.com/rss.xml using curl. The download is restricted to the HTTPS protocol, includes a 15-second connection timeout, and enforces a 5MiB file size limit to prevent resource exhaustion. The fetched data is used only for comparing article metadata (titles and publication dates) against the skill's included snapshot.
[INDIRECT_PROMPT_INJECTION]: The skill has the surface area to process external data via the RSS feed audit and local Markdown searches. However, the risk is negligible as the processing is limited to metadata comparison and local keyword matching, and the output is presented to the agent as structured JSON. The skill explicitly instructs the agent to treat information as something to understand and test rather than blindly follow.

josh-comeau-frontend