The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface (Category 8). In Step 4 and Step 6, it collects user-provided rules (Do's/Don'ts) and analyzes external content from user-provided URLs. According to the 'Integration' section, this data is saved to JSON and later "injected into the system prompt" for the writer agents. If the external content or user-defined rules contain malicious instructions, they could influence or override the downstream agent's behavior.
Ingestion points: SKILL.md Step 4 (User-provided Do's and Don'ts) and Step 6 (Content extracted from external URLs).
Boundary markers: No explicit delimiters or instruction-bypass warnings are mentioned for the persona injection phase.
Capability inventory: The skill performs file-write operations to save personas and network-read operations to fetch voice samples.
Sanitization: No explicit sanitization or validation of the text retrieved from URLs or provided by the user is described.
[EXTERNAL_DOWNLOADS]: Step 6 ("Voice Samples") allows users to provide URLs for the agent to read and analyze. This introduces a network operation surface on user-controlled input, which could potentially be exploited for Server-Side Request Forgery (SSRF) if the agent is directed to access sensitive internal resources or local metadata endpoints.
[COMMAND_EXECUTION]: The skill requires writing persona data to the file system at skills/blog/references/personas/<name>.json. While kebab-case is suggested, the filename is derived from user input (<name>), which could potentially lead to path traversal or file overwriting risks if the execution environment does not adequately sanitize the provided name before performing the write operation.

blog-persona