The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill requires a REDFOX_API_KEY for its search functionality. It correctly implements secure credential management by allowing users to provide the key via environment variables or a local JSON configuration file, avoiding hardcoded secrets.
[EXTERNAL_DOWNLOADS]: The skill communicates with https://redfox.hk/story/api/toutiao/searchWork and https://redfox.hk/story/api/toutiao/workDetail. These endpoints belong to the skill vendor (redfox-data) and are necessary for fetching the search data requested by the user.
[COMMAND_EXECUTION]: The scripts/search.py script uses subprocess.run to execute the system's open command. This is used solely to open the locally generated HTML report in the user's default browser for visualization and does not involve shell execution of untrusted input.
[PROMPT_INJECTION]: The skill processes untrusted content from external search results. While this presents an indirect prompt injection surface, the risk is mitigated as the skill primarily outputs data in structured formats (Markdown tables, CSV, HTML).
Ingestion points: Public content fetched from the Toutiao platform via the Redfox API (titles, author names, content snippets).
Boundary markers: The agent is instructed to present results in a structured table format.
Capability inventory: The skill can write local files (CSV, HTML) and open a browser window.
Sanitization: The HTML report template includes an escapeHTML utility in its JavaScript logic to sanitize data before rendering it in the browser.

toutiao-search