The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/report.py uses importlib.util to dynamically load and execute a Python module from a path calculated at runtime (open-webui-skill/scripts/client.py). This technique can be used to execute arbitrary local code if the file system is compromised.
Evidence: scripts/report.py lines 23-31.
[EXTERNAL_DOWNLOADS]: The skill performs outbound HTTP requests to an external service (Langfuse) using urllib.request.urlopen. While the host is configured via environment variables, this enables data exfiltration if the host is pointed to a malicious server.
Evidence: scripts/report.py lines 340-360.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests untrusted data from Open WebUI chat messages and channel posts.
Ingestion points: Data is fetched from Open WebUI channel messages, user chats, and knowledge items in scripts/report.py via the _collect_openwebui_activity function.
Boundary markers: None. The skill instructions in SKILL.md do not define delimiters (e.g., XML tags or triple backticks) to separate untrusted content from the agent's instructions, nor do they include warnings to ignore embedded instructions.
Capability inventory: The skill can post generated content back to Open WebUI channels using the open-webui-skill client, as described in the '連携' section of SKILL.md.
Sanitization: No sanitization or filtering is performed on the ingested message content before it is passed to the LLM for summarization in the summary_input object.

llm-activity-report-skill