The Agent Skills Directory

[COMMAND_EXECUTION]: The bundle includes utility scripts (scripts/sync_codex_marketplace.py, scripts/check_no_secrets.py) that use subprocess.run for repository maintenance (e.g., git commands). Additionally, the 'DIY Tier' in lib/backend_selector.py allows users to specify a custom posting command via an environment variable; however, this is explicitly documented as an advanced feature and is protected by a whitelist in lib/_env.py that prevents this variable from being loaded from an untrusted .env file on disk.
[EXTERNAL_DOWNLOADS]: The skill integrates with well-known services (Apify, Publora, and Pixfaro) for reading TikTok data, publishing videos, and generating images. All authenticated network requests using the requests library are explicitly configured with allow_redirects=False to prevent the accidental leakage of API credentials to third-party domains during HTTP redirects.
[INDIRECT_PROMPT_INJECTION]: The skill bundle identifies a potential attack surface where it ingests untrusted data from TikTok comments or captions via the Apify API. It proactively mitigates this risk through a comprehensive references/untrusted-content.md document that instructs the AI agent to treat all fetched content as data rather than instructions, maintaining strict approval gates and avoiding the execution of directives found within external content.
[SAFE]: The project follows industry best practices for secret management, using environment variables and .env.example templates. It even includes a developer script (scripts/check_no_secrets.py) specifically designed to prevent developers from accidentally committing real credentials to the repository.

tiktok-marketing