The Agent Skills Directory

[COMMAND_EXECUTION]: The instructions in SKILL.md direct the agent to execute shell commands using the pattern eval "$(python scripts/extract-listing.py)". This involves generating code at runtime and executing it directly in the shell environment. While the script currently outputs JavaScript intended for a browser tool, the instruction to eval command output is a dangerous pattern that could lead to arbitrary command execution if the script is modified or compromised.
[PROMPT_INJECTION]: The skill ingests untrusted content from walmart.com, specifically product titles and descriptions, which could contain malicious instructions designed to influence the agent's behavior.
Ingestion points: The scripts/extract-listing.py script extracts various text fields (name, brand, shortDescription) from the window.__NEXT_DATA__ object of Walmart category pages.
Boundary markers: None. The skill does not provide instructions to the agent to ignore or delimit embedded content within the scraped data.
Capability inventory: The skill has access to the browser-act tool and the bash environment for command execution.
Sanitization: There is no evidence of sanitization, validation, or filtering of the extracted product information before it is processed or presented to the agent.

walmart-category-listing