The Agent Skills Directory

[SAFE]: The skill follows standard security practices for API interaction, utilizing environment variables for credential management and generating short-lived JWTs for authentication.- [DATA_EXFILTRATION]: The script uses the requests library to communicate exclusively with the user-provided GHOST_URL. No unauthorized external network connections or exfiltration patterns were detected.- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from a Ghost CMS (posts, pages, tags) through the ghost-cli script. While this content is presented to the agent, the skill's capabilities are limited to API interactions and do not include high-risk operations such as arbitrary file writing or shell command execution. Evidence of this surface is found in the get_posts, get_pages, and get_tags methods in scripts/ghost-cli. No specific sanitization or boundary markers are implemented for the fetched content.

ghost-cli