The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it reads and processes blog post content which could contain malicious instructions.
Ingestion points: ghost_md.py fetches post content via g.get() and converts it to markdown for editing; SKILL.md describes operations that read posts via the Content and Admin APIs.
Boundary markers: There are no boundary markers or instructions to ignore embedded commands when processing retrieved blog content.
Capability inventory: The Ghost class in ghost_api.py provides full administrative capabilities including creating (post), updating (put), deleting (delete) posts/pages/members, and uploading images (upload).
Sanitization: The skill performs no sanitization or validation of the retrieved content to ensure it does not contain agent-targeting instructions before it is presented to the AI or processed by helper scripts.
[EXTERNAL_DOWNLOADS]: The skill interacts with external services to fulfill its primary functions.
Fetches image metadata and attribution information from Unsplash's official API (https://unsplash.com/napi/).
Interacts with a user-specified Ghost CMS instance via GHOST_API_URL.
Instructs the use of uv to download and run the markdownify and markdown packages from public registries.
[COMMAND_EXECUTION]: The documentation provides multiple examples of executing shell commands to run Python scripts with environment variables and package dependencies.
Example: `PYTHONPATH="$GHOST_SKILL_DIR" uv run --no-project python
<< 'PY'...`
These are standard for the skill's operational context and do not involve unsanitized user input in the shell context.

ghost-blog