The Agent Skills Directory

[COMMAND_EXECUTION]: The skill's operational instructions in SKILL.md advocate for the use of eval "$(python scripts/xxx.py '{offer_id}')". This pattern is susceptible to shell command injection. An attacker could provide a malicious offer_id containing shell metacharacters (e.g., semicolons, backticks, or $()) to execute arbitrary commands on the host system.
[REMOTE_CODE_EXECUTION]: The skill utilizes a dynamic execution model where local Python scripts (e.g., scripts/extract-sku-details.py) generate JavaScript payloads that are then executed in the browser context. The offer_id parameter is interpolated directly into these generated scripts without sanitization, creating a risk of cross-context code injection.
[DATA_EXFILTRATION]: By combining shell execution capabilities with browser automation, a compromised session could be used to exfiltrate sensitive local environment data or credentials to external domains.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to its processing of untrusted data from 1688.com.
Ingestion points: Data is fetched from detail.1688.com and parsed from the window.context object and DOM elements.
Boundary markers: Absent; there are no specific markers or instructions to isolate external data from the agent's core logic.
Capability inventory: Access to shell execution (eval) and browser automation (browser-act).
Sanitization: Absent; the Python scripts perform direct string concatenation of parameters into executable code blocks.

1688-product-detail