The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the user to download a source code repository from an untrusted GitHub account (https://github.com/pennydinh/marketing-pineline-share.git). This repository does not belong to the skill author (Aradotso) or a verified trusted organization.
[COMMAND_EXECUTION]: The instructions require executing shell commands such as npm install and npm run build on the downloaded third-party code. This is a high-risk operation as package installation scripts or the code itself could contain malicious logic that executes with the user's local permissions.
[CREDENTIALS_UNSAFE]: The documentation asks the user to provide sensitive credentials in a .env.local file, including REMOTION_AWS_SECRET_ACCESS_KEY and DATABASE_URL. While standard for local development, providing these secrets to an unverified third-party codebase increases the risk of credential exposure or exfiltration.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The scrapeNewsSource function (SKILL.md) ingest untrusted data from TechCrunch, Twitter/X, and LinkedIn.
Boundary markers: The scraped data is interpolated into AI prompts using JSON.stringify (SKILL.md), which is insufficient to prevent an attacker from embedding instructions within the scraped content that could influence the AI's behavior.
Capability inventory: The skill has the capability to execute shell commands (Remotion rendering), write files to the out/ directory, and perform network requests via scraping modules.
Sanitization: There is no evidence of sanitization or validation of the scraped data before it is sent to the LLM (Claude/OpenAI).

ultimate-ai-content-pipeline