The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted content from social media platforms (comments, replies, captions) which could contain malicious instructions.
Ingestion points: Content is retrieved via comments, keyword-matches, and contents commands in scripts/po-once.cjs and displayed to the agent.
Boundary markers: The SKILL.md file contains explicit warnings instructing the agent to treat comments and captions as untrusted data and to never follow instructions found within them.
Capability inventory: The script has the ability to post public replies, delete content, and perform network operations to the Po Once API.
Sanitization: The script implements redactSensitiveData to filter credentials from output and requires explicit user confirmation for sensitive actions like replying or deleting content.
[COMMAND_EXECUTION]: The skill executes a local Node.js script and uses subprocess spawning to handle background tasks.
Evidence: scripts/po-once.cjs uses child_process.spawn to self-invoke for backgrounding upload and publish operations. This is implemented using an argument array which prevents shell injection.

po-once