The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted audio content from external XiaoYuzhou URLs.
Ingestion points: The transcribe.sh script fetches audio data from CDN links discovered on user-provided web pages.
Boundary markers: The skill's instructions lack clear delimiters or specific system-level commands to prevent the LLM from following instructions that might be contained within the transcribed podcast audio.
Capability inventory: The skill uses powerful system tools including curl, ffmpeg, and python3, providing an exploitation surface if the agent is successfully manipulated.
Sanitization: No input sanitization is performed on the transcribed text before it is passed to Claude for article generation.
[DATA_EXFILTRATION]: The transcription script includes a Python block that explicitly disables SSL certificate verification (ssl._create_unverified_context()) if a local CA bundle is not found. This creates a vulnerability to Man-in-the-Middle (MitM) attacks that could result in the theft of the user's GROQ_API_KEY or the transcription data.
[COMMAND_EXECUTION]: The script uses curl to fetch content from user-supplied URLs. Without strict validation of the input URL, this could be used to perform Server-Side Request Forgery (SSRF) attacks against internal network resources accessible to the agent's environment.
[EXTERNAL_DOWNLOADS]: The SKILL.md file encourages users to download ffmpeg binaries from osxexperts.net if standard installation methods fail. This is an unverified third-party source, presenting a potential supply chain risk for the user's machine.

read-xiaoyuzhou-article