The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from a user's flomo account, which could contain malicious instructions designed to influence the agent's behavior.
Ingestion points: Memo content retrieved from https://v.flomoapp.com/mine during query and search workflows.
Boundary markers: No explicit delimiters or instructions are provided to the agent to treat memo content as data only and ignore any embedded instructions.
Capability inventory: The skill utilizes powerful browser automation tools including clicking, typing, and executing JavaScript within the page context.
Sanitization: There is no evidence of sanitization or filtering of the retrieved memo content before it is processed by the agent.
[DYNAMIC_EXECUTION]: The skill documentation encourages the agent to use specific JavaScript snippets as fallback mechanisms to interact with the Vue.js and Tiptap internals of the flomo web interface.
Evidence: references/ui-locators.md and references/workflows.md describe executing code like editor.commands.setContent(...) and __vue__.onSubmit() through browser automation tools.
[DATA_EXFILTRATION]: The skill is designed to read private user memos from a web-based note-taking service and provide summaries to the agent context. While this is the intended functionality, it constitutes a data exposure path where private notes are shared with the AI model.
Evidence: The query/search workflow in SKILL.md describes extracting recent_state, active_topics, and value_signals from live memo content.

flomo-web-crud