The Agent Skills Directory

[COMMAND_EXECUTION]: The skill operates by executing a local Python script at scripts/quark_search.py to perform its core functions, including environment preflight checks, resource searching, link validation, and triggering save operations.
[DATA_EXFILTRATION]: The skill performs network requests to non-whitelisted external domains: it queries https://s.panhunt.com/api for resource search results and communicates with https://drive-pc.quark.cn to validate share tokens and retrieve file details. Additionally, it interacts with a local API endpoint at http://localhost:9128 to communicate with the Quark desktop application.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from an external search aggregator, which presents a surface for indirect prompt injection attacks. Ingestion points: Search result metadata (notes, titles, and URLs) are fetched from the PanSou API and passed into the agent's context. Boundary markers: The command output does not implement explicit boundary markers or delimiters to isolate untrusted external content from the agent's instructions. Capability inventory: The skill has the capability to interface with a local application and open URLs in the user's browser. Sanitization: The script uses a strict alphanumeric regular expression to extract and validate share IDs, which provides a degree of protection against malformed or malicious URLs being processed by the local application logic.

quark-download