The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions explicitly recommend using bash to execute commands generated by Python scripts via shell expansion: eval "$(python scripts/extract-reviews.py)". This pattern is risky as it can lead to arbitrary command execution if the Python script output is compromised or influenced by external data.
[REMOTE_CODE_EXECUTION]: The skill uses a capability called browser-act which is an external tool invoked to perform browser operations. This represents a dependency that executes code outside the immediate scope of the skill's own logic.
[EXTERNAL_DOWNLOADS]: The skill attempts to invoke and potentially load configuration/usage for browser-act during pre-execution checks. If the tool is not present, it directs the agent to follow its guidance for installation/configuration from external sources.
[DYNAMIC_EXECUTION]: The script scripts/extract-reviews.py dynamically generates a JavaScript payload that is designed to be injected into a browser environment to extract data from the window.__NEXT_DATA__ object. This technique of runtime code assembly and injection is a common vector for complex attacks, although here it is used for data extraction.

walmart-product-reviews