The Agent Skills Directory

[SAFE]: The skill performs its stated function of downloading Xiaohongshu videos. It communicates with the vendor's API at https://redfox.hk/story/api/parseWork/videoDownload/xhs which is consistent with the author's identity (redfox-data).
[SAFE]: Credential management for the REDFOX_API_KEY follows standard practices, allowing users to provide the key via environment variables or a local configuration file (~/.qoder/apis/redfox.json). The script ensures secure file permissions (0o600) when saving the key.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it processes data from an external source and presents it to the agent.
Ingestion points: Data is retrieved from the redfox.hk API in scripts/downloader.py and passed to the agent's context.
Boundary markers: No explicit boundary markers or instructions to ignore embedded content are used when outputting the API's 'desc' field.
Capability inventory: The skill has network access via the requests library and file system write access in scripts/downloader.py.
Sanitization: The script validates input URL domains but does not sanitize the content returned by the external API before outputting it.

xiaohongshu-video-downloader