The Agent Skills Directory

Indirect Prompt Injection (HIGH): The skill creates a high-risk attack surface by consuming untrusted external data and providing tools to modify the platform state.
Ingestion points: Untrusted data enters the agent's context through article searches (item search), article retrieval (item get), and comment listing (comment list) as defined in SKILL.md.
Boundary markers: The skill documentation provides no instructions for the agent to use delimiters or ignore instructions found within retrieved articles or comments.
Capability inventory: The agent is granted capabilities with significant side effects, including item post, item update, item delete, and comment post.
Sanitization: There is no mention of sanitizing retrieved Markdown or validating that the content is strictly data and not executable instructions for the LLM.
Command Execution (LOW): The skill relies on an external shell script scripts/qiita.sh. It explicitly instructs the agent to use bash -c for execution to handle environment variables. While standard, this pattern requires the underlying script to be highly resilient against shell injection from parameters like --query or --title which may contain special characters from external sources.

qiita