The Agent Skills Directory

[DATA_EXPOSURE_AND_EXFILTRATION]: The skill demonstrates safe credential handling by requiring the REDFOX_API_KEY to be provided via environment variables, avoiding hardcoded secrets. Network operations are limited to the author's verified domain (redfox.hk) for the intended purpose of fetching metadata.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from Bilibili (video titles and author names) and incorporates it into agent responses and HTML reports. This is a standard functional requirement for a content aggregator.
Ingestion points: Video titles and creator names are retrieved via the queryPlayletMsgs API in scripts/playlet_bili_daily.py.
Boundary markers: The skill provides strict output templates in SKILL.md to maintain structure, though it does not use explicit delimiters around external data in terminal output.
Capability inventory: The skill can write to the local file system (generating HTML reports) and execute a browser to display findings.
Sanitization: Data is processed as raw strings; while this presents a theoretical surface for injection, the risk is minimized by the skill's specific use case and localized impact.
[DYNAMIC_EXECUTION]: The skill generates local HTML reports at runtime and uses the webbrowser module to open them. These operations are transparent, limited to the local machine, and triggered by user-initiated reporting requests.

playlet-bili-feed