The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest large volumes of untrusted data from the internet, creating a significant attack surface for indirect prompt injection.
Ingestion points: The skill retrieves content from Twitter, Reddit, YouTube transcripts, GitHub, and arbitrary URLs via Jina Reader (found in SKILL.md).
Boundary markers: The instructions do not define clear boundaries or provide "ignore" markers to prevent the agent from executing instructions embedded within the scraped data.
Capability inventory: The skill has access to network operations (requests), external command execution (subprocess), and file-parsing tools (feedparser).
Sanitization: No evidence of sanitization, filtering, or validation is present for the content fetched from remote platforms before it is provided to the agent.
[COMMAND_EXECUTION]: The skill frequently uses the subprocess module to orchestrate external command-line tools.
Evidence: Functions such as get_video_info and search_repos execute yt-dlp and gh CLI with parameters derived from search queries or URLs, which could lead to argument injection if not carefully handled by the underlying agent platform.
[CREDENTIALS_UNSAFE]: The skill's architecture relies on the manual export and local storage of sensitive session cookies and API tokens.
Evidence: Users are instructed to export browser cookies for Twitter, Reddit, and XiaoHongShu and store them in local configuration files like ~/.twitter-cli/config.json (found in SKILL.md).
Evidence: The skill utilizes environment variables for sensitive secrets such as GITHUB_TOKEN and EXA_API_KEY.
[EXTERNAL_DOWNLOADS]: The installation process automates the setup of multiple third-party tools and environments.
Evidence: The skill documentation notes that pip install agent-reach will automatically detect and install Node.js, the GitHub CLI, and various platform-specific scrapers like twitter-cli and yt-dlp (found in SKILL.md).

agent-reach-internet-access