The Agent Skills Directory

[COMMAND_EXECUTION]: The skill invokes several CLI tools to perform its tasks. prepare_article_source.py executes feishu2md to download content, and open_x_articles_browser.sh uses playwright-cli or npx to launch a browser session. Other utilities use ffmpeg for video transcoding and mmdc for Mermaid diagram rendering. These executions use standard list-based arguments or hardcoded command strings, minimizing injection risks.
[EXTERNAL_DOWNLOADS]: The skill interacts with the Feishu Open API (open.feishu.cn) to download Markdown documents and media files (videos/images) when a Feishu/Lark URL is provided as input. It also uses npx to dynamically run the @playwright/mcp package if not locally installed, which is a common pattern for Playwright-based tools.
[PROMPT_INJECTION]: As an indirect prompt injection surface, the skill ingests untrusted Markdown content from external Feishu/Lark URLs. This content is processed and formatted into HTML before being pasted into the X Articles editor.
Ingestion points: scripts/prepare_article_source.py via Feishu URL.
Boundary markers: None identified for the processed content during the paste operation.
Capability inventory: Browser automation (Playwright), file system writes, and subprocess execution across multiple scripts.
Sanitization: The skill performs basic sanitization by removing Feishu callout markers and normalizing blockquotes in prepare_article_source.py and parse_markdown.py.
[DATA_EXFILTRATION]: While the skill accesses the internet to fetch Feishu content and interacts with the browser, all data flow is consistent with the primary purpose of cross-posting articles. It manages a persistent browser profile in ~/.codex/browser-profiles/x-articles to store session cookies, which is a standard requirement for maintaining login states in automated browser workflows.

x-article-publisher