The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from an external platform (Xiaohongshu) through several functions.
Ingestion points: The search_feeds, get_feed_detail, and get_notification_mentions functions in scripts/cdp_publish.py extract content (notes, comments, and notifications) directly from the web page state and API responses.
Boundary markers: There are no explicit boundary markers or instructions to the agent to disregard instructions embedded within the scraped content.
Capability inventory: The skill has significant local capabilities, including file writing (_write_content_data_csv), media downloading (image_downloader.py), and browser automation control.
Sanitization: While the skill uses json.dumps to escape content before injecting it into JavaScript execution contexts, it does not sanitize the content before presenting it to the agent for decision-making (e.g., replying to comments).
[COMMAND_EXECUTION]: The skill executes local commands to manage the browser environment.
Evidence: scripts/chrome_launcher.py uses subprocess.Popen to launch the Google Chrome process with specific debugging flags (--remote-debugging-port). This is a legitimate requirement for CDP-based automation but represents a privileged capability.
[DYNAMIC_EXECUTION]: The core automation logic relies on executing dynamic code within the browser context.
Evidence: scripts/cdp_publish.py and scripts/feed_explorer.py use the Runtime.evaluate CDP command extensively to execute JavaScript snippets for DOM interaction, data extraction, and UI manipulation. The skill's own internal audit (docs/code-review-2026-03-07.md) notes that _fill_content uses innerHTML for text injection, which could lead to unintended HTML parsing if the input contains special characters.

RedBookSkills