The Agent Skills Directory

[COMMAND_EXECUTION]: The file references/newsjacking.md provides shell command templates using curl, jq, and xmllint to fetch news data. These templates use placeholder variables (e.g., QUERY, SUBREDDIT) within command strings. If an agent executes these by directly interpolating user-provided text without proper escaping or sanitization, it could result in command injection.
[INDIRECT_PROMPT_INJECTION]: The skill consumes untrusted data from external sources, presenting a risk of indirect prompt injection where malicious instructions in external content could influence agent behavior.
Ingestion points: External RSS feeds (Google News), public APIs (Hacker News, Reddit), and web-scraped content from journalist sites and social media as described in references/newsjacking.md, references/journalist-pitching.md, and references/podcast-guest-prep.md.
Boundary markers: The instructions lack explicit delimiters or safety markers to isolate external data from the agent's core instructions when generating pitches or briefs.
Capability inventory: The skill includes network access via curl, web browsing capabilities, and file system access for reading and writing data in the .agents/ directory.
Sanitization: No specific sanitization or validation logic is provided for processing data fetched from external URLs before it is used in prompt construction.
[PRIVILEGE_ESCALATION]: In references/newsjacking.md, the skill instructs the user or agent to perform system-level package installation using brew install jq. Recommending the installation of software increases the potential attack surface of the environment.
[EXTERNAL_DOWNLOADS]: The skill uses curl to fetch information from well-known services such as Google News, Reddit, and Hacker News (Algolia). These network operations are used for legitimate research purposes and do not involve untrusted code execution or sensitive data exfiltration.

public-relations