The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill is designed to download obfuscated JavaScript source code from URLs provided in the arguments for local analysis and processing.
[COMMAND_EXECUTION]: The agent is instructed to use npm to install the @babel suite and prettier. It also generates and executes multiple Node.js scripts (e.g., scripts/step1_string_decrypt.js) to perform code transformations.
[REMOTE_CODE_EXECUTION]: The skill utilizes the Node.js vm module or the evaluate_script tool to execute segments of the untrusted, obfuscated code to resolve dynamic string values and verify deobfuscation logic.
[PROMPT_INJECTION]: The skill processes external source code, creating a surface for indirect prompt injection if the input code contains malicious instructions formatted as comments or strings.
Ingestion points: Obfuscated code is ingested from local files or remote URLs via $ARGUMENTS.
Boundary markers: There are no explicit instructions or delimiters defined to prevent the agent from following instructions embedded within the processed code.
Capability inventory: The skill possesses capabilities for file system writes, shell command execution, and JavaScript evaluation.
Sanitization: Input code is parsed as AST but not otherwise sanitized for natural language instructions.

ast-deobfuscate