The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from external websites via playwright-cli (as seen in SKILL.md, references/blog.md, references/podcast.md, and references/video.md).
Ingestion points: The skill opens arbitrary URLs provided by the user or found on pages to extract titles, descriptions, and full article bodies.
Boundary markers: There are no explicit boundary markers or 'ignore' instructions provided to the agent to distinguish between valid metadata and malicious instructions embedded in the external page content.
Capability inventory: The skill has access to shell execution (bash), Git operations, GitHub PR creation (gh CLI), and file system writes.
Sanitization: While references/environment.md contains a warning to 'ensure titles are properly quoted' to avoid shell metacharacters, this relies on the agent's interpretation and does not constitute a robust technical sanitization mechanism.
[COMMAND_EXECUTION]: The skill exhibits patterns where untrusted data extracted from the web is interpolated directly into shell commands, creating a risk of command injection.
Evidence: In references/environment.md, the agent is instructed to use extracted metadata in commands like git commit -m "Add <type>: <title>" and gh pr create --title "Add <type>: <title>".
Evidence: In references/podcast.md, the variable $IMAGE_URL (scraped from a podcast page) is used in a shell snippet: npx cloudinary-cli upload "$IMAGE_URL".
[EXTERNAL_DOWNLOADS]: The skill uses npx to dynamically run the cloudinary-cli package. While Cloudinary is a well-known service, the use of npx involves fetching and executing code from the NPM registry at runtime.

add-content