The Agent Skills Directory

[COMMAND_EXECUTION]: The /librarian from twitter command executes the bird CLI via a Bash shell, passing a user-supplied URL as a direct argument. This pattern is vulnerable to shell command injection if the input URL contains shell metacharacters.
[DATA_EXFILTRATION]: The skill accesses sensitive session transcripts located in ~/.claude/projects/. These files contain a comprehensive history of agent interactions and may contain private code, credentials, or other sensitive data handled during sessions.
[PROMPT_INJECTION]: The skill implements an ingestion pipeline for external data from the web, social media, and email. This creates an attack surface for indirect prompt injection where malicious instructions embedded in source content could hijack the agent's synthesis process.
Ingestion points: from web, from gmail, from twitter, from calendar, and from claude commands in SKILL.md ingest content from external or local sources.
Boundary markers: The skill does not provide instructions to use delimiters or specific safety markers to isolate external data from instructions.
Capability inventory: The skill possesses filesystem read/write access, shell execution capabilities, and network-enabled MCP tools.
Sanitization: No sanitization or filtering logic is specified for external content before it is processed by the agent.
[EXTERNAL_DOWNLOADS]: The skill utilizes Microsoft's markitdown package for document conversion and requires the bird CLI for social media data extraction.

librarian