The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill requires the installation of the pyzhihu-cli package from an unverified third-party repository (github.com/BAIGUANGMEI/zhihu-cli). This introduces a dependency on external code that has not been vetted for security.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data and possesses account-modifying capabilities, creating a vulnerability to indirect injection attacks.
Ingestion points: Untrusted data enters the agent context through search results (zhihu search), question details (zhihu question), answers/comments (zhihu answer), and hot topic lists (zhihu hot).
Boundary markers: The instructions lack explicit delimiters or warnings to ignore instructions embedded within the content fetched from Zhihu.
Capability inventory: The skill includes powerful actions such as deleting questions/pins/articles (zhihu delete-*), posting new content (zhihu ask, zhihu pin, zhihu article), and managing interactions (zhihu vote, zhihu follow-question).
Sanitization: There is no evidence of sanitization or filtering of external content before it is processed by the agent, which could allow malicious instructions in Zhihu posts to influence agent behavior (e.g., tricking the agent into deleting user content).
[CREDENTIALS_UNSAFE]: The skill interacts with sensitive authentication data stored in the local file system at ~/.zhihu-cli/cookies.json. While the skill attempts to follow best practices for file permissions, the existence and handling of this credential store by the CLI tool provides a point of exposure for account takeover if the environment is compromised.

zhihu-cli