The Agent Skills Directory

[DATA_EXPOSURE_AND_EXFILTRATION]: The skill retrieves the REDFOX_API_KEY from environment variables or by reading local shell configuration files such as ~/.zshrc, ~/.bashrc, and ~/.profile. This sensitive file access is scoped to retrieving credentials necessary for the vendor's API. Data is sent to the vendor's official domain at redfox.hk.- [UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The generated HTML reports load external JavaScript libraries (html2canvas, jsPDF) from Cloudflare's public CDN (cdnjs.cloudflare.com). These are well-known, trusted resources used for providing image and PDF export functionality.- [PERSISTENCE_MECHANISMS]: The skill includes instructions for the AI agent to assist users in persistently storing the API key by modifying system environment variables or shell configuration files. This behavior is intended for standard tool configuration and is performed transparently.- [INDIRECT_PROMPT_INJECTION]: The skill ingests external content from social media notes via the RedFox API. While this creates a potential surface for indirect prompt injection, the scripts include a clean_text function to sanitize input by removing URLs, image tags, and special characters. \n
Ingestion points: scripts/xhs_daily_fetcher.py and scripts/gen_xhs_html.py via the redfox.hk API response.\n
Boundary markers: None explicitly defined in instructions.\n
Capability inventory: File writing (HTML generation) and command execution via Python scripts.\n
Sanitization: clean_text function filters out potentially malicious characters and patterns.

xiaohongshu-dailytop