The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The Preflight (Auto-Update) script in SKILL.md uses pipx to install code directly from an external GitHub repository (https://github.com/Panniantong/agent-reach/archive/main.zip). Additionally, references/setup-channels.md recommends installing packages via git URLs (e.g., https://github.com/Panniantong/mcp-server-weibo.git). These operations download unversioned third-party source code at runtime.
[REMOTE_CODE_EXECUTION]: Following the download, the skill executes the newly installed agent-reach package. The automated update mechanism also fetches version data from the GitHub API and triggers upgrades using pipx upgrade, leading to the execution of code that may change after the skill's initial deployment.
[COMMAND_EXECUTION]: The skill heavily relies on the Bash tool to perform operations, including running third-party CLI tools like xhs-cli, twitter-cli, rdt-cli, and yt-dlp to interact with external platforms.
[CREDENTIALS_UNSAFE]: The skill provides instructions for the agent to extract authentication cookies directly from the user's browser using the command agent-reach configure --from-browser chrome. This command accesses sensitive session data stored locally, which is a high-risk operation.
[PROMPT_INJECTION]: The skill has a significant indirect prompt injection surface due to its primary function of ingesting untrusted web content.
Ingestion points: The skill reads content from numerous external sources including Twitter, Reddit, Weibo, Bilibili, and arbitrary URLs via jina.ai and exa.ai (documented in references/web.md, references/social.md, and references/video.md).
Boundary markers: No explicit boundary markers or instructions to ignore embedded commands in the fetched content are present.
Capability inventory: The agent has access to the Bash, Write, and Edit tools, enabling arbitrary command execution and file modification if the agent is manipulated by malicious content.
Sanitization: There is no evidence of sanitization or filtering of the content retrieved from external platforms before it is processed by the agent.

agent-reach