The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains explicit defensive instructions in SKILL.md and references/output-contract.md that command the agent to treat all input (URLs, files, and text) as untrusted data and to ignore any imperative commands or attempts to override the skill's operating rules found within that data.
[DATA_EXFILTRATION]: A mandatory 'Sensitive Information Gate' is defined in the workflow to identify and remove credentials, API keys, passwords, internal hostnames, and absolute local paths from processed content and downstream image generation prompts, preventing accidental leakage of sensitive information.
[INDIRECT_PROMPT_INJECTION]: The skill implements a robust evidence chain for processing untrusted data. It requires the agent to isolate source-derived strings into standard JSON string arrays within prompts, explicitly declaring them as 'inert data' to prevent the LLM from executing instructions hidden in the input material.
[COMMAND_EXECUTION]: The provided scripts/validate.py is a development utility executed via a Makefile. Technical analysis confirms it only uses standard libraries for file path resolution and hash-based integrity verification of local assets, with no suspicious network or OS-level operations.
[EXTERNAL_DOWNLOADS]: The skill references its official GitHub repository github.com/KKenny0/social-content-kit-skill for installation and updates, which is the expected behavior for a vendor-provided agent skill.

social-content-kit