The Agent Skills Directory

[PERSISTENCE]: The scripts/cultural_tourism_report.py file contains an install_subscription function that enables persistent execution of the skill. On macOS, it creates a LaunchAgent at ~/Library/LaunchAgents/com.qoder.cultural-tourism-wechat-feed.plist. On Linux systems, it modifies the user's crontab to schedule daily execution. While declared as a feature, these mechanisms represent persistent system modifications.\n- [COMMAND_EXECUTION]: The skill is vulnerable to shell command injection. In the install_subscription function within scripts/cultural_tourism_report.py, the keyword argument (extracted from user input) is interpolated directly into a shell command string used in subprocess.run(shell=True) when updating the Linux crontab. An attacker providing a malicious keyword could execute arbitrary commands with the user's privileges.\n- [EXTERNAL_DOWNLOADS]: The skill uses the requests library to fetch data from https://redfox.hk/story/api/parseWork/queryGzhPlayletMsgs. This is a vendor-controlled domain associated with the skill's author (redfox-data).\n- [CREDENTIALS_UNSAFE]: Authentication is managed via a REDFOX_API_KEY, which the skill expects to find in environment variables or a local configuration file at ~/.qoder/apis/redfox.json. The documentation provides instructions for users to manually supply and store this credential.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes article data (titles, authors, and metadata) from an external API and presents it back to the agent for terminal output and JSON summarization. This ingestion of untrusted external content without strict boundary markers for the AI's processing creates a surface for indirect prompt injection attacks.

cultural-tourism-wechat-feed