The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external websites to inform the generation of marketing content and image prompts. If a scraped website contains malicious instructions, it could attempt to influence the agent's behavior or the content of the generated posts.
Ingestion points: scripts/analyze-web.js and scripts/search-competitors.js scrape text, headlines, and features from user-provided URLs.
Boundary markers: The scraped content is interpolated into prompts in scripts/generate-hooks.sh without explicit delimiters or instructions to ignore embedded commands.
Capability inventory: The skill possesses the capability to publish content to live social media feeds (scripts/publish-carousel.sh) and execute local scripts.
Sanitization: While the scripts use jq to ensure shell-level safety for variable expansion, there is no semantic sanitization of the scraped text before it is passed to the AI models.
[COMMAND_EXECUTION]: The skill uses a series of Node.js and Bash scripts to orchestrate its workflow. This includes running browser automation via Playwright and image generation via Python scripts.
[EXTERNAL_DOWNLOADS]: The skill utilizes several standard external dependencies and tools to fulfill its primary purpose.
Uses playwright for website analysis and requires the installation of the Chromium browser.
Utilizes the uv package runner to manage Python dependencies, specifically google-genai for interacting with the Gemini API and pillow for image processing.

viraloop