The Agent Skills Directory

Indirect Prompt Injection (HIGH): The skill's core functionality involves ingesting untrusted data from external web sources which is then processed by an LLM and outputted to high-privilege communication channels (Telegram/WhatsApp).
Ingestion Points: scripts/news-fetcher.sh, scripts/fetch_news.py, and modular fetchers in scripts/fetchers/ (huxiu, youtube, wechat) fetch titles, summaries, and full text from external URLs.
Boundary Markers: The summarization prompt in scripts/news-summarizer.md lacks robust delimiters or explicit instructions to treat fetched content as data only, making it vulnerable to embedded instructions within news articles.
Capability Inventory: The skill utilizes web_fetch, web_search, and the message tool (for Telegram/WhatsApp delivery).
Sanitization: No evidence of sanitization or filtering of fetched content before it is interpolated into the summarization prompt.
Persistence (LOW): scripts/cron-setup.sh and scripts/news-daily/INSTALL.md provide instructions and scripts to create cron jobs. While this is the intended functionality for scheduled news, it establishes a persistence mechanism on the host system.
External Dependencies (LOW): The documentation recommends installing yt-dlp and jq via system package managers or pip. These are well-known tools, but they represent external code that is required for full v2 functionality.

news-daily