The Agent Skills Directory

[DATA_EXFILTRATION]: The skill makes network requests to api.tikhub.io. This is the official domain for the skill author (TikHub) and is necessary for its primary function of fetching social media data.
[CREDENTIALS_UNSAFE]: The skill utilizes the TIKHUB_API_KEY environment variable for authentication. This follows standard security best practices for avoiding hardcoded secrets while providing the agent with necessary credentials.
[INDIRECT_PROMPT_INJECTION]: As the skill retrieves user-generated content from Xiaohongshu (such as notes and comments), it processes untrusted data.
Ingestion points: API responses from endpoints like get_note_comments and get_video_note_detail.
Boundary markers: None explicitly defined in this skill file.
Capability inventory: The skill itself primarily performs read operations; however, it mentions handing off data to other tools like social-media-downloader.
Sanitization: Not explicitly implemented in the skill instructions.
[COMMAND_EXECUTION]: The skill references a vendor-provided CLI tool tikhub-find-endpoint. This appears to be a helper utility for identifying relevant API paths within the vendor's ecosystem.

xiaohongshu