The Agent Skills Directory

[DATA_EXFILTRATION]: The skill uses a Python script to send user-supplied keywords to an external API (api.xyskill.xyz) to search for reference materials. Although the domain appears related to the author (xyaz1313), it is a non-whitelisted destination for user data.
[INDIRECT_PROMPT_INJECTION]: The skill retrieves text snippets from external sources and incorporates them into the agent's context and final reports, creating an injection surface.
Ingestion points: Data is fetched from the api.xyskill.xyz endpoint and the local references/atoms.jsonl file via the atoms-search.py script.
Boundary markers: The skill uses standard Markdown headers for its reports but lacks explicit protective delimiters or instructions for the agent to ignore potential commands embedded within the retrieved "knowledge" snippets.
Capability inventory: The skill has the capability to execute a bundled Python script and read local files within the skill directory and common agent configuration paths (e.g., ~/.xy/config.json).
Sanitization: There is no evidence of explicit validation, filtering, or sanitization of the retrieved text before it is presented to the agent.
[COMMAND_EXECUTION]: The skill instructions explicitly direct the agent to execute a bundled Python script (scripts/atoms-search.py) using the shell. This is a legitimate requirement for the skill's search functionality.
[EXTERNAL_DOWNLOADS]: The atoms-search.py script performs network requests to api.xyskill.xyz to fetch knowledge base updates and search results. The domain follows the naming pattern of the skill author's infrastructure.

xy-content-scan