The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests and processes untrusted content from external websites.
Ingestion points: Web content is retrieved via curl from proxies, or via scripts/fetch_weixin.py and scripts/fetch_feishu.py.
Boundary markers: The skill does not implement delimiters or instructions to ignore embedded commands in the fetched content before presenting it to the agent.
Capability inventory: The agent has permissions to execute shell commands (curl, npx), run local Python scripts, and write files to the local file system (~/Downloads).
Sanitization: No sanitization or filtering of fetched HTML or Markdown is performed to remove potential injection strings.
[COMMAND_EXECUTION]: Executes shell commands to run local Python scripts (fetch_weixin.py, fetch_feishu.py) and standard tools like curl and npx.
[REMOTE_CODE_EXECUTION]: The skill uses npx to download and execute the agent-fetch utility from the npm registry at runtime.
[EXTERNAL_DOWNLOADS]: Fetches web content through proxy services including Jina AI's r.jina.ai and defuddle.md. It also utilizes playwright which downloads browser binaries during installation.
[DATA_EXFILTRATION]: User-provided URLs are transmitted to external services (r.jina.ai, defuddle.md) to perform content conversion. This involves sending the target URL to these third-party services.

qiaomu-markdown-proxy