The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill references the @paragraph-com/sdk package from the official NPM registry and references the source code on the vendor's GitHub repository (paragraph-xyz/paragraph-sdk-js). These are standard resources provided for the skill's documented functionality.
[COMMAND_EXECUTION]: Code examples demonstrate the use of curl for interacting with the Paragraph REST API and npm for installing the SDK. These tools are used appropriately for their stated developer-focused purposes.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted external data, such as post content, newsletter drafts, and subscriber records, creating a surface for potential indirect prompt injection attacks.
Ingestion points: Data is brought into the agent's context through methods that fetch publication posts (api.posts.list, api.posts.get), library content (api.content.get), and subscriber information (api.subscribers.get).
Boundary markers: The instructions include explicit requirements for user approval before performing irreversible actions, such as publishing content live or sending custom emails.
Capability inventory: The skill has access to Bash (curl, npm, npx), Read, Write, and WebFetch tools to manage publication resources.
Sanitization: While server-side validation is mentioned for rich documents, the skill does not detail specific agent-side sanitization for processing raw markdown or text content.

paragraph-api