The Agent Skills Directory

[DATA_EXFILTRATION]: The skill includes a reference script ('references/definitive-guide-reviews-section.md') that uses the 'browser_cookie3' library to read sensitive cookies from the user's Safari browser. These cookies are then used to authenticate session requests to 'reddit.com'. Accessing browser cookies is a high-risk operation that can expose user sessions and sensitive data.
[REMOTE_CODE_EXECUTION]: The skill utilizes command-line patterns ('SKILL.md', 'references/huggingface-card-benchmark-verification.md') where data from HuggingFace is fetched via 'curl' and piped directly to 'python3'. While the target service is well-known and the scripts are visible one-liners, this pattern remains a potential vector for remote code execution if source content is compromised.
[COMMAND_EXECUTION]: The skill instructions involve the execution of various shell commands, including 'curl' for network interaction, 'python3' for JSON processing and scraping, and 'hermes chat' for cross-model auditing.
[EXTERNAL_DOWNLOADS]: The skill fetches metadata and benchmarks from HuggingFace ('huggingface.co') and content from Reddit ('reddit.com'). These are recognized well-known services and the interaction is necessary for the skill's primary research functions.
[PROMPT_INJECTION]: The skill processes untrusted data from external sources, including Reddit comments and HuggingFace README files, creating a surface for indirect prompt injection. * Ingestion points: Web data from Reddit and HuggingFace APIs. * Boundary markers: Instructions advise the agent to verify claims against primary sources and separate storage roles. * Capability inventory: Access to shell execution, Python interpreters, and external API tool calls. * Sanitization: Relies on manual verification and comparison against official benchmarks rather than programmatic sanitization.

content-style