The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes content from markdown files within 'contents/blog/' and 'contents/newsletter/'.
Ingestion points: Source files are read in Step 1 and Step 3.
Boundary markers: There are no explicit instructions or delimiters provided to the agent to distinguish between the skill's instructions and the content being processed.
Capability inventory: The skill uses file-read, file-write, and shell execution (curl) capabilities.
Sanitization: No sanitization or validation of the input content is mentioned before it is used for command construction or prompt interpolation.
[COMMAND_EXECUTION]: In Step 4, the skill instructs the agent to execute a shell command: 'curl -sSL -o "x-articles/{slug}/images/{n}.{ext}" "{url}"'.
Evidence: The variables '{slug}', '{ext}', and '{url}' are all derived directly from the content or metadata of the source markdown files. If these files contain shell metacharacters (e.g., semicolons, backticks, or pipes), it could lead to arbitrary command execution on the host system.
[EXTERNAL_DOWNLOADS]: The skill performs automated downloads using curl from URLs identified in the document body.
Evidence: Step 4 instructs the agent to download every image URL found in the text, specifying Cloudinary as the expected provider. However, the skill lack a strict domain whitelist or verification step, meaning it would attempt to download from any URL formatted as an image source in the processed markdown.

x-article