The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes instructions to execute curl and jq commands for interacting with external APIs. These commands use environment variables (SEMRUSH_API_KEY and UNSPLASH_CLIENT_ID) to authenticate, which is a secure method for managing secrets within a skill.
[EXTERNAL_DOWNLOADS]: The skill fetches keyword data from Semrush (api.semrush.com) and image metadata from Unsplash (api.unsplash.com). Both are well-known technology services, and the data retrieved is used strictly for informing the blog creation process.
[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to ingest and analyze untrusted data from external sources.
Ingestion points: Search engine results pages (SERP) via WebSearch and responses from Semrush and Unsplash APIs.
Boundary markers: The instructions do not specify delimiters or markers to separate untrusted external data from the system prompt.
Capability inventory: The skill uses network operations (curl) and JSON parsing (jq) to process data, but does not include arbitrary file-write or subprocess capabilities.
Sanitization: There are no explicit instructions for sanitizing or filtering the content ingested from external search results.

write-blog