The Agent Skills Directory

[CREDENTIALS_UNSAFE]: Hardcoded Feishu App Token (ND8ObCuSya5Dv3sREZYc03Ilngh) and Table ID (tblaHDM5kjtikIl9) are present in scripts/generate_tags.py and SKILL.md. These credentials grant access to a specific Feishu Bitable database. The OPTIMIZATION.md file misleadingly claims these were removed in version 1.5.0.
[COMMAND_EXECUTION]: The script test_main_flow.py uses subprocess.run to execute Python scripts within the skill directory using the current Python interpreter. While intended for testing, this pattern allows for shell command execution within the agent environment.
[PROMPT_INJECTION]: The SKILL.md file contains instructions to proactively trigger the skill even when the user does not explicitly request it (e.g., 'Even if they don't explicitly ask to collect, trigger this skill proactively.'), which overrides standard agent intent handling and user control.
[DATA_EXFILTRATION]: The skill transmits collected social media content and metadata to the Feishu API (https://open.feishu.cn/open-apis). While this is the intended functionality, the use of hardcoded tokens allows for potential unauthorized data access or exposure.
[INDIRECT_PROMPT_INJECTION]: The skill processes content fetched from external URLs and interpolates it directly into an AI prompt for summarization and tagging (Step 4.2 in SKILL.md). There are no boundary markers or sanitization procedures to prevent malicious instructions embedded in the external content from influencing the agent.
Ingestion points: extract_content.py (web content fetching) and ocr_image.py (screenshot text extraction).
Boundary markers: Absent in the prompt template provided in SKILL.md.
Capability inventory: Subprocess execution via test_main_flow.py and network writing via save_to_bitable.py.
Sanitization: No escaping or validation of external content before interpolation.

content-collector