The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill implements a self-update mechanism documented in reference/update.md that queries the official vendor domain https://openapi.zhihu.com for new versions and downloads updates via npx or ZIP files. These downloads originate from the verified vendor infrastructure.
[DATA_EXFILTRATION]: The skill manages Zhihu OpenAPI credentials by storing them in a local JSON file (~/.zhihu/openapi-credentials.json) with restricted permissions. It transmits data and cryptographic signatures to the vendor's API at https://openapi.zhihu.com for publishing purposes as intended by its core functionality.
[COMMAND_EXECUTION]: The skill executes platform-specific shell commands (open, Start-Process, xdg-open) to launch the system browser for previewing local HTML files. It also uses curl for API communication and invokes a provided Python script (scripts/finalize_validate_json.py) to ensure data integrity during the validation phase.
[PROMPT_INJECTION]: The skill processes untrusted user content (Markdown/HTML) but includes comprehensive security instructions for the agent to mitigate indirect injection. It explicitly forbids dangerous HTML elements such as script, iframe, and on* event handlers in conversion.md, and requires the use of a validation script to enforce these constraints before any data is processed for preview or publication.

zhihu-publisher