The Agent Skills Directory

[PERSISTENCE]: The references/onboarding.md file provides explicit instructions for users to persist their API keys by appending export commands to shell configuration files such as ~/.bashrc and ~/.zshrc.
[INDIRECT_PROMPT_INJECTION]: The skill retrieves and processes external data (TikTok shop names, types, and metrics) which could contain adversarial instructions targeting the agent.
Ingestion points: Data retrieved from the Kalodata API in scripts/kalodata_shop_search.py and scripts/kalodata_shop_detail.py.
Boundary markers: The instructions do not define clear delimiters or include warnings to ignore instructions embedded within the retrieved shop data.
Capability inventory: The skill has capabilities for network operations via urllib and local file system writes in the linkfox/ directory.
Sanitization: There is no evidence of filtering or escaping external content before it is displayed to the agent.
[COMMAND_EXECUTION]: The skill relies on the execution of local Python scripts (scripts/kalodata_shop_search.py, scripts/kalodata_shop_detail.py, and scripts/onboarding.py) which take JSON-formatted strings as CLI arguments.

linkfox-kalodata-tiktok-shop