The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The setup instructions include a command that downloads a script from https://artifact.lx.netease.com/download/youdaonote-cli/install.sh and pipes it directly into the bash interpreter. This pattern allows for arbitrary code execution on the user's system without prior inspection of the script's contents.\n- [EXTERNAL_DOWNLOADS]: The skill fetches an installation script and potentially other components from artifact.lx.netease.com, which is an external domain not included in the provided trusted list.\n- [COMMAND_EXECUTION]: The skill relies on executing the youdaonote CLI tool and other shell utilities (like jq and cat). It constructs and executes shell commands which can be a risk if inputs from external sources are not properly sanitized.\n- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes external data from notes and web pages.\n
Ingestion points: The skill reads note content via youdaonote read and clips web content via youdaonote clip.\n
Boundary markers: There are no markers or instructions used to separate the external data from the agent's instructions.\n
Capability inventory: The skill can execute local CLI tools, write to the file system, and interact with network services through the CLI.\n
Sanitization: The skill does not perform any sanitization or validation of the content retrieved from notes or web pages before processing it.

youdao-note