The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of shell commands including curl, node, and agent-browser to fetch data from remote APIs and scrape web content.
[EXTERNAL_DOWNLOADS]: Fetches data from numerous external domains including public.api.bsky.app, hachyderm.io, hn.algolia.com, reddit.com, archive.org, scrapecreators.com, and apify.com. These are used to retrieve social media post content and metadata.
[DYNAMIC_EXECUTION]: The skill employs dynamic path resolution to locate and execute a vendored Node.js script. Specifically, it instructs the agent to 'Glob the newest vendored version at runtime' for the bird-search.mjs script located within another skill's cache directory (~/.claude/plugins/cache/last30days-skill/...).
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted text and HTML from third-party social media platforms. This data is returned in a structured JSON format, which acts as an entry point for content that could influence downstream agent behavior if processed without sanitization.
Ingestion points: Fetched post text and HTML from platforms like X, LinkedIn, Reddit, and Mastodon via curl or agent-browser (documented in SKILL.md and references/strategies.md).
Boundary markers: The skill returns data in a structured JSON schema defined in references/output-schema.md, providing a structural boundary.
Capability inventory: Capability to execute shell commands (curl, node), perform network operations, and use browser automation (agent-browser).
Sanitization: No evidence of sanitization or filtering of the fetched content is present before it is returned in the output.

social-fetch