The Agent Skills Directory

[DATA_EXFILTRATION]: The skill makes network requests to https://redfox.hk/story/api/fb/postComment to retrieve comment data. This domain belongs to the skill's author, and these operations are essential for the primary functionality of fetching public feedback.
[COMMAND_EXECUTION]: The script scripts/consolidate_report.py utilizes subprocess.run (on macOS/Linux) and os.startfile (on Windows) to automatically open generated HTML reports in the user's default web browser. This behavior is restricted to opening locally generated report files in the ~/Downloads/QoderReports directory.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and summarize external Facebook comments, which presents a surface for indirect prompt injection. However, the skill mitigates the risks associated with visualizing this content by using HTML escaping.
Ingestion points: External comments are retrieved via scripts/facebook_comment_search.py and processed by the agent.
Boundary markers: The instructions do not define specific markers for the summary generation prompt, though the output is expected in a structured report format.
Capability inventory: The skill has the capability to write local files, communicate with the vendor's API, and open local files in a browser.
Sanitization: The skill implement an escape_html utility in its Python scripts to sanitize content before it is embedded in the HTML report templates, preventing potential code injection or cross-site scripting (XSS) during report viewing.

facebook-comment