The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill retrieves note metadata and engagement statistics from a vendor API at redfox.hk. It also downloads note cover images using curl from URLs provided in the note metadata for visual analysis.
[COMMAND_EXECUTION]: The workflow involves executing a local Python script (scripts/fetch_note_detail.py) to interface with the API and uses shell commands (curl) to download media assets to a temporary directory.
[DATA_EXFILTRATION]: While the skill transmits note IDs and links to the vendor API to fetch data, this is the core intended functionality. It requires a REDFOX_API_KEY provided by the user via environment variables, following standard secret management practices.
[PROMPT_INJECTION]: The skill processes untrusted external content (note titles, descriptions, and tags) during its analysis phase. While this presents an indirect prompt injection surface, the risk is inherent to the skill's purpose as an analyzer of third-party content.
Ingestion points: noteTitle, contentDesc, and hashTags fields from fetched Xiaohongshu notes (referenced in references/core_workflow.md).
Boundary markers: The skill uses Markdown headers to separate data fields but does not include explicit instructions to the agent to ignore embedded commands within the external text.
Capability inventory: Subprocess execution of Python scripts and curl for file downloads.
Sanitization: No explicit sanitization or filtering of the fetched text is performed before it is processed by the agent.

xhs-note-analyzer