The Agent Skills Directory

CREDENTIALS_UNSAFE (HIGH): The file config.json contains a hardcoded refresh_token and session cookie (PHPSESSID). This leaks active authentication credentials for a Pixiv account, allowing unauthorized access to the account associated with those tokens.
DATA_EXFILTRATION (HIGH): The post command in scripts/pixiv-cli.js allows the agent to upload an arbitrary file from a specified <filepath> to Pixiv. If an attacker uses indirect prompt injection to provide a malicious path (e.g., ~/.ssh/id_rsa), the agent could be tricked into uploading private keys or other sensitive files to the attacker's Pixiv account.
PROMPT_INJECTION (HIGH): The skill is highly vulnerable to Indirect Prompt Injection (Category 8).
Ingestion points: The skill fetches untrusted data (titles, descriptions, and user metadata) from the Pixiv API via search, ranking, and user commands in scripts/pixiv-cli.js.
Boundary markers: No boundary markers or sanitization are present to separate external content from agent instructions.
Capability inventory: The skill possesses powerful capabilities including arbitrary file reading/uploading (post command) and file writing (download command).
Sanitization: There is no escaping or filtering of the external metadata before it is returned to the agent's context.
Impact: An attacker can craft a Pixiv post with a title containing instructions that command the agent to exfiltrate the user's .env or configuration files using the provided post tool.

pixiv