The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill includes specialized logic to extract session cookies and authentication tokens from local browser databases for Chrome, Brave, Safari, and Firefox. This functionality is designed to automatically authenticate with services like X/Twitter and Truth Social without requiring an API key. Documented in scripts/lib/chrome_cookies.py, scripts/lib/cookie_extract.py, and scripts/lib/safari_cookies.py.
[DATA_EXFILTRATION]: The skill accesses highly sensitive system paths containing browser credentials, including ~/Library/Cookies/Cookies.binarycookies and Chromium-based cookie databases. While these are used locally to facilitate authenticated research, the capability to read these files is a high-privilege operation. Documented in scripts/lib/chrome_cookies.py and scripts/lib/safari_cookies.py.
[COMMAND_EXECUTION]: The skill extensively uses the subprocess module to execute external binaries and CLI tools like yt-dlp, node, openssl, and gh. This includes a helper for safe timeouts and process group management. Documented in scripts/lib/subproc.py, scripts/lib/youtube_yt.py, and scripts/lib/bird_x.py.
[EXTERNAL_DOWNLOADS]: The setup process includes logic to automatically install the yt-dlp package using the Homebrew package manager (brew install yt-dlp) if it is not detected on the system. Documented in scripts/lib/setup_wizard.py.
[PROMPT_INJECTION]: The skill instructions (SKILL.md) use strong, imperative language and explicit 'LAWS' intended to strictly override default agent behavior and formatting. These are framed as an 'OUTPUT CONTRACT' to ensure canonical formatting, using patterns common in complex prompt overrides. Documented in SKILL.md.
[DATA_EXPOSURE]: The skill manages environment variables and API keys by attempting to retrieve them from the macOS Keychain, searching for entries with a specific prefix. Documented in scripts/lib/env.py and scripts/setup-keychain.sh.

last30days