The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructions include the use of npx -y reelary, which downloads and executes the reelary package from the public npm registry. This is the vendor's official CLI tool and represents standard functionality for this service.
[COMMAND_EXECUTION]: The documentation provides shell command examples for environments without MCP support, using npx to execute the reelary CLI tool. These examples interpolate user-provided content directly into the command line (e.g., "<script>"), which could lead to command injection if the user input contains shell metacharacters.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data from the user, such as blog posts or scripts, and pass them to downstream tools and commands.
Ingestion points: User-provided scripts, outlines, blog posts, or themes processed in SKILL.md.
Boundary markers: No specific delimiters or boundary instructions are provided to separate user content from system instructions.
Capability inventory: The skill utilizes reelary_* MCP tools and shell command execution via npx.
Sanitization: There are no instructions for sanitizing or escaping the user-provided text before it is interpolated into tool arguments or shell commands.

rough-cut