The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external content from URLs to generate publication drafts, creating a surface for indirect prompt injection attacks.
Ingestion points: Ingests external data when a user provides a web URL to "extract content and images/videos" for a draft (found in SKILL.md).
Boundary markers: No delimiters or "ignore embedded instructions" warnings are defined for the content extracted from external URLs.
Capability inventory: The skill can execute shell commands via python, perform network operations via Playwright, and access the local filesystem to read/write media and profile data.
Sanitization: No explicit sanitization, validation, or filtering of the extracted web content is mentioned in the instructions.
[COMMAND_EXECUTION]: The skill relies on shell command execution to perform all its core functions, including environment checks, login, and publishing.
Evidence: Numerous commands calling python skills/shared/scripts/xhs_publish.py are found in SKILL.md and references/commands.md.
[DATA_EXFILTRATION]: The skill manages sensitive social media login states (cookies) stored locally, which represents a high-value target for exfiltration.
Evidence: Login state is persisted in the ~/.easel-browser-profiles/XiaohongshuProfile directory as described in SKILL.md and references/commands.md.

skill-xhs-publisher