The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill communicates with a vendor-managed API at https://redfox.hk/story/api/parseWork/queryPlayletMsgs to retrieve short drama content. This is a primary function of the skill and uses the vendor's own infrastructure.
[COMMAND_EXECUTION]: The Python script assets/daily_report.py utilizes webbrowser.open() to automatically launch the generated HTML report in the system's default browser upon completion. While this is an intended feature, it involves executing a local command based on script output.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests and processes external data (such as article titles and descriptions) from the RedFox API. If this external data contains malicious instructions, it could attempt to influence the agent's behavior during the report generation and analysis process.
Ingestion points: assets/daily_report.py and scripts/playlet_wechat_daily.py (via fetch_playlet_data function).
Boundary markers: None identified in the prompt instructions to isolate external data.
Capability inventory: File system writes to ~/Downloads/QoderReports and ~/.workbuddy/cache, network access to redfox.hk, and browser interaction.
Sanitization: The script performs standard JSON parsing and HTML templating but lacks explicit sanitization or filtering for adversarial prompt content embedded in article metadata.

playlet-wechat-feed