The Agent Skills Directory

[COMMAND_EXECUTION]: The script uses standard command-line argument parsing to define search parameters (sources, limit, query). There are no instances of shell injection or arbitrary command execution.
[EXTERNAL_DOWNLOADS]: The skill fetches data from reputable public domains including hn.algolia.com, www.reddit.com, trends.google.com, and newsapi.org. These are legitimate data sources for the skill's stated purpose. User-provided RSS feeds via the --rss flag are also supported.
[CREDENTIALS_UNSAFE]: The skill reads an optional NEWSAPI_KEY from the environment. This is a standard and recommended practice for secret management, avoiding hardcoded credentials. The key is used solely for the NewsAPI request and is not logged or stored.
[DATA_EXFILTRATION]: While the skill performs network requests, they are outbound 'GET' requests to fetch trending data. There is no logic present that reads sensitive local files (like SSH keys or AWS configs) to send them externally.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external APIs (titles and descriptions from Reddit/HN). However, it outputs this data as structured JSON for a downstream orchestrator and does not execute the content itself, mitigating the risk of injection attacks at this stage.

trend-scout