The Agent Skills Directory

[COMMAND_EXECUTION]: The skill's instructions in SKILL.md provide shell command templates (e.g., URL=$(python scripts/build-url.py '{keyword}' ...) and RESULT=$(browser-act ... eval "$(python scripts/extract-page.py --keyword '{keyword}')")) that interpolate user-supplied parameters directly into the command string. If the agent does not strictly validate or sanitize the {keyword} input, a malicious user could provide input that breaks out of the shell quotes to execute arbitrary commands on the host system.
[REMOTE_CODE_EXECUTION]: The skill uses Python scripts (scripts/extract-page.py and scripts/enum-categories.py) to dynamically generate JavaScript code at runtime. This generated code is then passed to the browser-act tool for execution within a browser environment. Although the scripts attempt rudimentary escaping of user input, the pattern of dynamic code generation from templates increases the security attack surface.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its handling of untrusted external data.
Ingestion points: The skill fetches and processes listing titles, seller usernames, and category labels from eBay search results in scripts/extract-page.py.
Boundary markers: The skill instructions do not specify any delimiters (like XML tags or triple quotes) or provide guidance for the agent to ignore instructions potentially embedded in the scraped content.
Capability inventory: The skill environment allows for shell execution via bash and DOM manipulation via browser-act.
Sanitization: The skill lacks explicit sanitization or filtering of the scraped content before it is returned to the agent's context, allowing malicious instructions hidden in eBay listings to potentially influence the agent's behavior.

ebay-sold-listings-search