The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the subprocess module in keyword_collector.py to invoke the curl utility for API interactions. It properly uses argument lists to mitigate shell injection risks.
[EXTERNAL_DOWNLOADS]: The skill fetches keyword and product metadata from the Sorftime API at https://mcp.sorftime.com. These downloads are neutral and align with the skill's primary function of market research.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it processes external data from Amazon (via the Sorftime API) and includes it in prompts for the AI agent.
Ingestion points: Untrusted keyword data and product descriptions are fetched in keyword_collector.py.
Boundary markers: Prompt templates in workflow.py use clear delimiters like 【待分类关键词】 to separate instructions from external data.
Capability inventory: The skill environment permits command execution through curl and file-writing operations to generate reports.
Sanitization: Data is parsed and control characters are escaped in data_parser.py, though there is no semantic sanitization of the keyword strings before processing.

keyword-research