The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses shell commands and Python scripts to gather data for the press release.
Step 2A executes a Python script via a shell heredoc to read docs/learning-graph/book-metrics.json and extract book statistics.
Step 2B uses a shell pipeline (curl | grep | sed) to extract URL locations from a sitemap.
[EXTERNAL_DOWNLOADS]: The skill fetches content from a remote sitemap.xml file to verify the structure of a published site when the local repository is not available. The URL used is a placeholder (https://SITE/sitemap.xml) intended to be replaced by the target textbook's URL.
[REMOTE_CODE_EXECUTION]: An automated scan flagged the sitemap extraction command as potential remote code execution. However, manual analysis confirms that the downloaded content is piped into text processing tools (grep and sed) for data extraction only, and the output is treated as text for counting project elements rather than being executed as code.
[PROMPT_INJECTION]: The skill processes untrusted external data from the sitemap and local project descriptions. While this represents a potential surface for indirect prompt injection, the risk is minimal as the instructions focus on structured data extraction (counting URLs, identifying page titles) and generating specific journalistic content in AP style.

press-release-generator