The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill executes and diagnoses untrusted JavaScript code using Node.js vm contexts (found in references/profiles/env-patch/scripts/env-diagnose.js). This is a core feature for reverse engineering challenges. The scripts include explicit warnings that node:vm is not a security boundary and advise running the tool within an external disposable sandbox.
[COMMAND_EXECUTION]: Diagnostic and test scripts, such as scripts/check_reverse_env.py and scripts/validate_skill.py, use the subprocess module to verify the installation and versions of required local tools like node, npm, curl, and git.
[EXTERNAL_DOWNLOADS]: The static-ast and browser-hook-snippets profiles contain package.json and package-lock.json files that reference standard dependencies (like Babel) from the official npm registry (registry.npmjs.org).
[DATA_EXFILTRATION]: The skill includes a dedicated tool, scripts/evidence_normalizer.py, designed to mitigate data exfiltration risks by pseudonymizing sensitive fields (passwords, tokens, cookies) in network captures before they are used in reports or evidence packages.

spider-king