The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on executing the sau (social-auto-upload) CLI tool to perform its primary functions. It provides example scripts in Python, Bash, and PowerShell to facilitate this.
Evidence: scripts/examples/zhihu_cli_template.py uses subprocess.run() to execute commands.
Security Note: The Python implementation correctly passes arguments as a list rather than a single string, which is a best practice to prevent shell injection vulnerabilities.
[INDIRECT_PROMPT_INJECTION]: The skill handles external data by reading local files (Markdown, HTML, TXT) and video metadata to be uploaded to the Zhihu platform. This constitutes an attack surface where malicious instructions could theoretically be embedded in the content files.
Ingestion points: Content files specified via the --content-file argument and video files via the --file argument in SKILL.md.
Boundary markers: None explicitly defined for the content of the files being uploaded.
Capability inventory: Command execution via the sau CLI tool as demonstrated in scripts/examples/zhihu_cli_template.py.
Sanitization: Not explicitly mentioned; the skill acts as a relay to the CLI tool for the provided file paths and metadata.

zhihu-upload