The Agent Skills Directory

[DATA_EXFILTRATION]: Multiple scripts in the skill (e.g., scripts/crawl_xhs.py, scripts/fetch_rank.py, scripts/fetch_xhs_hot_articles.py, scripts/gen_xhs_html.py, scripts/xhs_daily_fetcher.py, scripts/xiaohongshu-similar-account.py) automatically read the content of sensitive shell configuration files, including ~/.zshrc, ~/.bashrc, ~/.bash_profile, ~/.profile, and ~/.zprofile. This behavior is used to search for the REDFOX_API_KEY environment variable export, but it exposes the full contents of these sensitive files to the script's logic.\n- [EXTERNAL_DOWNLOADS]: The skill makes network requests to the redfox.hk domain to retrieve social media analytics data. This domain belongs to the official vendor (redfox-data) associated with the skill.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from Xiaohongshu notes (titles and descriptions) retrieved via the RedFox API. Ingestion points: Xiaohongshu note data retrieved from the RedFox API. Boundary markers: The skill uses Markdown tables and predefined HTML templates for data presentation. Capability inventory: The skill can perform network requests to redfox.hk and write report files to the local file system. Sanitization: The scripts implement clean_text functions and regex patterns to strip URLs, HTML tags, and special characters from the processed notes before they are included in the reports.

xiaohongshu-inspiration