The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The setup-xhs-mcp skill downloads external resources including docker-compose.yml and compiled binaries from an untrusted GitHub repository (github.com/xpzouying/xiaohongshu-mcp).
[REMOTE_CODE_EXECUTION]: The skill facilitates the execution of unverified remote code by fetching and running Docker containers and binary releases from a third-party source at runtime.
[COMMAND_EXECUTION]: The setup-xhs-mcp script executes high-risk shell commands such as docker compose up -d and utilizes curl piped to shell logic to install the underlying MCP service.
[DATA_EXFILTRATION]: The skill accesses sensitive local files including ~/.claude/settings.json, .claude/settings.json, and .cursor/mcp.json to read and modify client configuration settings.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it retrieves and processes untrusted user-generated content from Xiaohongshu (notes and comments) which could influence agent behavior.
Ingestion points: Content is ingested via list_feeds, search_feeds, and get_feed_detail in xhs-explore/SKILL.md and xhs-search/SKILL.md.
Boundary markers: None; the skill does not use delimiters to isolate retrieved content from instructions.
Capability inventory: The agent has write-capabilities including publish_content, post_comment_to_feed, and like_feed across multiple sub-skills.
Sanitization: No evidence of sanitization or filtering of external social media content before it is presented to the agent model.

xiaohongshu