The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/validate_payload.mjs uses the dynamic import() statement to load Node.js modules from a path constructed at runtime using the --repo argument provided by the user. This allows the execution of code from a path that is not hardcoded or strictly validated within the skill itself.
[PRIVILEGE_ESCALATION]: The skill utilizes the SUPABASE_SERVICE_ROLE_KEY to perform direct writes to a production Supabase database. This key provides administrative bypass of Row Level Security (RLS) and represents a high-privilege capability for a skill.
[INDIRECT_PROMPT_INJECTION]: The skill processes external, untrusted content from Google Docs and Markdown files which is then used to generate payloads for a live website.
Ingestion points: Content is fetched from Google Docs using google-workspace tool calls (e.g., get_doc_as_markdown) in Step 1.
Boundary markers: The instructions do not define clear delimiters or "ignore instructions" warnings for the agent when processing the external article content.
Capability inventory: The skill can execute shell commands (curl), perform network POST/PATCH operations to a database, and modify Google Drive files and Google Sheets.
Sanitization: The skill includes an esc function in scripts/build_payload.mjs for basic HTML entity escaping and uses a Tiptap-based schema validation in scripts/validate_payload.mjs to ensure data structure integrity.
[COMMAND_EXECUTION]: The skill performs several shell-based operations, including running Node.js scripts and using curl to interact with the Supabase PostgREST API. It also executes SQL queries via a Supabase MCP to resolve database identifiers.
[EXTERNAL_DOWNLOADS]: The skill references an external repository for installation and setup.
Evidence: The SKILL.md file provides a command to fetch the skill builder from the author's GitHub repository: https://github.com/peter-tu-zynkr/zynkr-skill-builder.

seo-publish-article