The Agent Skills Directory

[SAFE]: No malicious patterns, unauthorized command executions, or persistence mechanisms were detected in the skill instructions or scripts.
[EXTERNAL_DOWNLOADS]: The skill documentation and implementation examples reference official Pinterest domains (e.g., api.pinterest.com, s.pinimg.com) and well-known infrastructure providers (Google, Amazon, Arkose Labs). These references are necessary for interacting with the Pinterest platform and are documented neutrally.
[INDIRECT_PROMPT_INJECTION]: The reference files contain raw HTML and JavaScript scrapes from the Pinterest developer portal. While this constitutes an attack surface, no malicious instructions were found in the current content.
Ingestion points: Files references/api.md, references/llms.md, references/llms-full.md, and references/llms-small.md are ingested into the agent context.
Boundary markers: The scraped data dumps lack explicit delimiters or warnings to ignore embedded instructions.
Capability inventory: The skill documents capabilities for network operations (fetch, requests, curl) which could be misused if malicious instructions were present.
Sanitization: The content consists of raw scrapes and is not sanitized, but audited content shows only legitimate platform logic.
[CREDENTIALS_SAFE]: The skill correctly uses placeholders for authentication tokens and provides best-practice guidance on secure credential management, such as avoiding token exposure in client-side code.

pinterest-api