The Agent Skills Directory

[COMMAND_EXECUTION]: Several scripts within the skill, such as scaffold_leadbook.py, render-pdf.py, and prepare-pdf-visual-audit.py, use subprocess.run() to execute system utilities including google-chrome, pdftoppm, and montage. These calls are used to automate the build pipeline and generate visual assets.
[DATA_EXFILTRATION]: The xhs-research.py script communicates with a local REST API to collect research data. While it defaults to loopback addresses, it includes a flag (--allow-remote-base-url) that allows sending short-lived session tokens to remote endpoints, which could be misused if a user is directed to an untrusted server.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface (Category 8) by processing untrusted data from external sources.
Ingestion points: Data is ingested from Xiaohongshu notes and comments via xhs-research.py, as well as WeChat articles referenced in AUTHORITY_ACCOUNTS.md.
Boundary markers: The skill documentation (references/runtime-and-privacy.md) acknowledges that user-generated content is untrusted; however, the provided scripts do not automatically implement strict delimiters or 'ignore instructions' markers when interpolating this data into markdown files read by the agent.
Capability inventory: The agent possesses capabilities to execute shell commands (via provided scripts) and perform extensive file system operations within the project directory.
Sanitization: The scripts perform basic data normalization but lack specific sanitization to filter out malicious LLM instructions embedded in the ingested social media content.

leadbook