The Agent Skills Directory

[DATA_EXPOSURE]: The skill manages API credentials using a local config.json file (with a provided config.example.json). This is a standard and safe practice for secret management in agent skills, ensuring that sensitive tokens are stored locally and not hardcoded in instructions or scripts.
[COMMAND_EXECUTION]: The skill executes a local script (scripts/upload.mjs) to perform the upload. The execution path is controlled and uses a temporary file containing user-approved content, which prevents arbitrary command injection.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted Markdown files to generate frontmatter metadata. While this represents a potential attack surface, the risk is significantly mitigated by a mandatory human-in-the-loop confirmation step. The agent is instructed to present the generated data to the user and wait for explicit approval before proceeding with the upload.
[DATA_EXFILTRATION]: Network communication is restricted to a user-defined baseUrl retrieved from the local configuration. The script uses standard HTTP POST requests to the blog's official API endpoint, aligning with the stated purpose of the skill.

typos-publish