The Agent Skills Directory

[DATA_EXFILTRATION]: The script implements a strict validate_host function that restricts network requests to authorized domains (xiaohongshu.com, xhslink.com). This control ensures that the optional XHS_COOKIE (authentication session) is only sent to the intended service provider and prevents exfiltration to malicious third-party hosts.
[CREDENTIALS_UNSAFE]: The skill handles authentication data through environment variables or a private configuration file. The code includes a debug utility in clip_rednote_env.py that specifically redacts sensitive keys such as cookies, tokens, and secrets, preventing accidental exposure in logs or terminal output.
[COMMAND_EXECUTION]: File operations and network requests are performed using Python's built-in urllib and pathlib modules. The skill does not use eval(), exec(), or subprocess to run arbitrary shell commands, sticking to its documented purpose of file management and parsing.
[EXTERNAL_DOWNLOADS]: The skill fetches media assets (images and videos) directly from the platform's content delivery networks to the local filesystem. These operations are scoped to the user's Downloads folder and are triggered only by the specific note being archived.

soia-pkm-clip-rednote