The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill reads external data from LinkedIn, creating a vulnerability surface for indirect attacks.
Ingestion points: Untrusted text from posts, comments, and profiles is fetched via the Apify API in lib/apify_client.py and utilized in several drafting skills.
Boundary markers: The skill includes a robust security rule in references/untrusted-content.md, explicitly instructing the agent to ignore any embedded directives in fetched data.
Capability inventory: The agent can publish content via Publora or execute a local command (Tier 2), but all sensitive actions require explicit user confirmation through a standardized approval card (lib/approval.py).
Sanitization: Content is used purely as drafting context; the final output is reviewed by the user, providing a human-in-the-loop checkpoint.
[COMMAND_EXECUTION]: The skill provides an optional feature to run local commands for publishing operations.
Logic: In lib/backend_selector.py, the skill can execute a command specified in the LINKEDIN_SKILLS_CUSTOM_POSTER environment variable.
Mitigation: The command is executed using subprocess.run() with a split argument list and no shell, which effectively prevents shell injection through parameters like the post URL. The feature is documented as an advanced 'Tier 2' capability.
[CREDENTIALS_SAFE]: Proactive credential auditing is integrated into the development workflow.
Security Script: The repository includes scripts/check_no_secrets.py, which uses regex patterns to scan for hardcoded tokens before they can be committed to the repository.
Management: Secret management is handled via environment variables and gitignored .env files, which is the recommended practice for securing API keys for Apify, Publora, and Pixfaro.

linkedin-marketing