The Agent Skills Directory

EXTERNAL_DOWNLOADS (MEDIUM): The README.md instructions require downloading configuration files from https://raw.githubusercontent.com/xpzouying/xiaohongshu-mcp/main/docker/docker-compose.yml. The 'xpzouying' organization is not on the trusted list, posing a risk of unverifiable dependency.
COMMAND_EXECUTION (LOW): The script simple_publish.py uses subprocess.run to execute a cp command. While intended for moving cover images, arbitrary command execution via environment variable injection (e.g., in XHS_IMAGE_DIR) is a theoretical risk.
PROMPT_INJECTION (LOW): The skill provides an indirect prompt injection surface when processing external HTML content from WeChat articles.
Ingestion points: publisher.py and scripts/content_adapter.py ingest raw HTML content from user-provided files or strings.
Boundary markers: Absent. The skill does not use delimiters or instructions to ignore embedded commands in the source content.
Capability inventory: subprocess.run (file operations) and requests.post (publishing to local API).
Sanitization: Limited to basic regex-based HTML tag removal (re.sub(r'<[^>]+>', ' ', content)), which may not prevent malicious instructions embedded in the text from influencing the agent's summarization logic.
DATA_EXFILTRATION (LOW): The skill documentation indicates it relies on session cookies stored in ~/xiaohongshu-mcp/docker/data/cookies.json. While it only sends this data to the local service, the presence of these credentials on disk is a sensitive factor.

xiaohongshu-publisher