The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill contains a hardcoded API key (4dfdf794141101d7bb8ece0294dbbc02) for the TianAPI service across multiple files including SKILL.md, README.md, and API_CONFIG.md. This key is used to authenticate requests to https://apis.tianapi.com/weibohot/index. Hardcoding secrets in skill files exposes them to anyone with access to the skill and is a major security risk.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from two main sources: the Weibo Hot Search API and external Web Search results.
Ingestion points: Data enters the agent context via API calls in SKILL.md (Step 1) and subsequent web searches for each trending topic (Step 2).
Boundary markers: The instructions do not specify any delimiters or safety markers to isolate the fetched content from the agent's instructions.
Capability inventory: The skill possesses the ability to execute shell commands (bash via curl), perform network operations, and write files to the local file system.
Sanitization: There is no evidence of sanitization or filtering applied to the external data before it is processed by the AI to generate product concepts and scoring. This creates a surface where malicious content on a trending topic or a poisoned search result could potentially influence the agent's decision-making or file-writing behavior.

weibo-trends-analyzer