The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes automated tests in scripts/tests/test_alice_efficiency.py and scripts/tests/test_host_search.py that utilize subprocess.run to execute local shell scripts. These operations are restricted to the test environment and are used to verify script logic without posing a threat to the user's system during normal usage.
[EXTERNAL_DOWNLOADS]: The skill interacts with official Yandex infrastructure, including api.webmaster.yandex.net for API calls and webmaster.yandex.ru for retrieving neural search efficiency data. These network operations are essential for the skill's functionality and are directed at trusted vendor endpoints.
[CREDENTIALS_UNSAFE]: The skill requires a Yandex OAuth token and a session cookie. It correctly implements secret management by instructing the user to store these values in a local .env file, which is excluded from the core code, thereby avoiding credential exposure.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from Yandex services and presents it to the agent in TSV and summary formats. While the ingestion of external data represents a potential attack surface, the risk is mitigated by the fact that the data originates from a known, trusted service provider (Yandex) and is processed using standard parsing techniques.

yandex-webmaster