The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8) because it processes untrusted user-provided materials to generate note content without employing boundary markers or sanitization. A malicious input could potentially trick the agent into executing unintended actions during the content generation or publishing phase.
Ingestion points: User-provided materials or subjects used to generate note content (Step 1 in SKILL.md).
Boundary markers: Absent in the instructions provided to the agent for note creation.
Capability inventory: The agent executes shell scripts (scripts/render_xhs.py, scripts/publish_xhs.py) to process and publish generated content.
Sanitization: No sanitization or validation of the input materials is performed before they are incorporated into the note generation process.
[COMMAND_EXECUTION]: The skill instructs the agent to execute local Python and Node.js scripts to perform rendering and publishing tasks. While these scripts are part of the skill's distribution, this capability provides an execution path for generated content, which could be exploited if the agent is successfully injected.
[EXTERNAL_DOWNLOADS]: The skill depends on several external libraries such as xhs, playwright, marked, and markdown. The xhs library is a third-party, unofficial API wrapper for Xiaohongshu. While standard for this use case, it is not from a verified trusted organization and constitutes a dependency on an external package registry.

xhs-note-creator