The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run() in scripts/browser_utils.py to execute the curl command for network requests.
Evidence: subprocess.run(["curl", "-sL", ...]) is called with an argument list rather than a single shell string.
Context: This is used to fetch product data from Amazon, which is a core part of the skill's advertised functionality. The implementation follows security best practices by avoiding shell=True.
[EXTERNAL_DOWNLOADS]: The skill performs outbound network requests to Amazon domains to retrieve listing context for analysis.
Evidence: The fetch_page function in scripts/browser_utils.py targets URLs constructed from a list of official Amazon domains.
Context: As these requests target a well-known service for legitimate product data retrieval, this behavior is considered safe under the trusted source rule.
[PROMPT_INJECTION]: The skill processes external data from user-uploaded advertising reports and fetched web content, presenting a surface for indirect prompt injection.
Ingestion points: scripts/clean_search_term_report.py (processes CSV/Excel files) and scripts/fetch_listing_context.py (processes HTML content).
Boundary markers: The scripts do not use specific delimiters or warnings when interpolating this external content into the final Markdown report.
Capability inventory: The skill can read/write files and execute shell commands (curl).
Sanitization: Standard Unicode normalization is applied to inputs, though not specifically designed to prevent prompt injection. The risk is assessed as low given the structured Python processing logic.

zach-search-term-report-analyzer