The Agent Skills Directory

[DATA_EXFILTRATION]: The skill requires users to provide sensitive platform session cookies (e.g., TikTok cookies for private data access like 'fetch_user_collect') which are then transmitted to the external domain aconfig.cn. While the skill documentation provides a security warning, this functionality creates a direct pathway for potential credential harvesting.
[EXTERNAL_DOWNLOADS]: The documentation for the WeChat component explicitly recommends that users utilize external decryption tools and third-party code repositories (specifically referencing 'evil0ctal.github.io' and associated GitHub links), which are unverifiable and originate from an untrusted source.
[COMMAND_EXECUTION]: The skill requires the 'curl' binary to interact with remote APIs. It is configured to execute multiple automated network requests across different platform sub-modules, which could be exploited if malicious payloads are returned by the remote service.
[PROMPT_INJECTION]: The internal logic instructs the agent to 'execute all planned queries autonomously,' which encourages the agent to carry out complex data collection chains without individual step-by-step user confirmation, increasing the risk of unintended actions.
[DATA_EXFILTRATION]: The skill ingests untrusted data from various social media platforms, including comments, posts, and user metadata. This creates an attack surface for indirect prompt injection, where malicious strings from external content could attempt to influence the agent's behavior during data processing steps.

maxhub-skills