The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides the user with an explicit command to execute a local binary: ~/.claude/plugins/cache/nowork-studio/notfair/<version>/bin/notfair-content-calendar. This utility is a vendor-provided tool (from nowork-studio) designed to render the generated JSON data as a visual calendar in a web browser.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from the Google Search Console (GSC) API and interpolates it into prompts for downstream agents.
Ingestion points: Step 2 fetches query and page data directly from the GSC API.
Boundary markers: The skill lacks explicit delimiters or instructions to ignore embedded commands when processing GSC query strings.
Capability inventory: The skill writes to the local file system (content-calendar.json) and generates a writerPrompt field intended to control the behavior of the /content-writer skill.
Sanitization: While the skill enforces quality checks like 'hook-driven titles', it does not describe mechanisms to sanitize or escape potential prompt injection strings found within GSC query data.
[DATA_EXPOSURE]: The skill reads from and writes to the ~/.notfair/ directory, including caching sensitive search performance data in gsc-cache.json. This behavior is consistent with the skill's stated purpose of SEO analysis and roadmap generation.

content-planner