The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The crawler implementations for Toutiao and WeChat contain hardcoded session cookies. This practice exposes active authentication tokens within the skill's source code.
Evidence: scripts/crawlers/toutiao.py (Line 23) contains a FIXED_COOKIE string with multiple session identifiers, including passport_auth_status_ss, ssid_ucp_sso_v1, and toutiao_sso_user_ss.
Evidence: scripts/crawlers/wechat.py (Line 22) contains a FIXED_COOKIE string with session-related keys such as RK and ptcz.
[PROMPT_INJECTION]: The skill presents an indirect prompt injection surface (Category 8) by processing untrusted article content from external websites into the agent's context.
Ingestion points: Article HTML is fetched from remote URLs in scripts/crawlers/base.py and the platform-specific crawler implementations.
Boundary markers: Absent. The scripts/formatter.py utility generates Markdown output without utilizing delimiters or explicit instructions to the agent to disregard potentially malicious content within the article text.
Capability inventory: The skill has the capability to write files to the local file system via scripts/extract_news.py and scripts/crawlers/base.py.
Sanitization: No sanitization or filtering of the extracted text is performed before it is formatted for the agent.
[COMMAND_EXECUTION]: The skill performs routine file system operations to store the extracted news data.
Evidence: scripts/extract_news.py and scripts/crawlers/base.py use standard Python file-writing methods (json.dump, Path.write_text) to save extracted article content as JSON and Markdown files.
[DATA_EXFILTRATION]: The skill performs network operations to retrieve content from well-known news and social media platforms.
Evidence: Crawler modules perform HTTP requests to domains including mp.weixin.qq.com, www.toutiao.com, www.163.com, www.sohu.com, and news.qq.com.

news-extractor