The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The script scripts/check_sensitive_words.py contains logic to scan sensitive shell configuration files, including ~/.zshrc, ~/.bashrc, ~/.bash_profile, ~/.profile, and ~/.zprofile, to extract the REDFOX_API_KEY. Accessing these files exposes the agent to all environment variables and secrets stored within the user's shell profile.
[EXTERNAL_DOWNLOADS]: The skill provides instructions in references/alipay-recharge.md to download and install the @alipay/agent-payment utility from the npm registry using npx during the automated recharge process. This utility is from a well-known service used to manage API credits.
[COMMAND_EXECUTION]: The skill implements a dynamic recharge workflow that involves executing multiple shell commands using the alipay-bot CLI tool to handle payment links, submit transactions, and poll for payment status based on data received from the API.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection by fetching and processing untrusted text from user-provided URLs and uploaded documents (DOCX, TXT, MD, etc.).
Ingestion points: Untrusted content is retrieved via the extract_from_file and extract_from_web functions in scripts/check_sensitive_words.py.
Boundary markers: Absent. The agent is instructed to process the raw extracted text without explicit delimiters or instructions to ignore embedded commands.
Capability inventory: The skill utilizes network requests via urllib, web scraping with playwright, and financial transaction management via alipay-bot.
Sanitization: The script filters for prohibited words but does not provide sanitization against adversarial instructions within the source text.

xiaohongshu-prohibited-word