The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill extracts content from external Xiaohongshu notes using scripts/dump_note.py and returns it to the agent as Markdown, creating a vulnerability to instructions embedded in external content.
Ingestion points: Content is fetched from arbitrary note URLs via scripts/dump_note.py.
Boundary markers: Absent. The skill does not use delimiters or instructions to the agent to ignore embedded commands within the extracted note data.
Capability inventory: The skill possesses significant capabilities including publishing notes, uploading files, commenting, and following users.
Sanitization: Absent. No sanitization or filtering of external note content is performed before it is presented to the agent.
[CREDENTIALS_UNSAFE]: The skill manages authentication by storing session cookies in rednote_cookies.json. While necessary for browser automation persistence, this file contains sensitive authentication tokens in plain text on the local filesystem.
[COMMAND_EXECUTION]: The scripts/publish_note.py script accepts a list of file paths via the --image-urls argument and passes them to Playwright's set_files method. An agent could be manipulated via prompt injection to provide paths to sensitive local files (such as ~/.ssh/id_rsa), which the script would then attempt to upload to the Xiaohongshu platform.

rednote-skill