The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill extracts text from local files to populate web forms, creating a surface for indirect prompt injection.
Ingestion points: The scripts/parse_note.py script reads user-provided files to extract title, content, and tags.
Boundary markers: The instructions do not use delimiters or explicit warnings to the agent to treat the parsed content as untrusted data, which could allow embedded commands to influence agent behavior.
Capability inventory: The agent uses agent-browser to perform actions such as navigating pages, filling forms, and clicking interaction buttons (including a publish button) in an authenticated session.
Sanitization: The parsing logic removes Markdown formatting markers but does not perform semantic sanitization to prevent natural language instructions from being processed by the agent.

xiaohongshu-publisher