The Agent Skills Directory

[DATA_EXFILTRATION]: The script setup-cdp-chrome.js accesses sensitive user data by copying the Google Chrome profile directory (e.g., ~/Library/Application Support/Google/Chrome on macOS or AppData/Local/Google/Chrome/User Data on Windows) to a local debug directory. This directory contains session cookies and other personal data. This access is documented as a requirement for maintaining login states during automated scraping.
[COMMAND_EXECUTION]: The skill frequently executes shell commands and subprocesses using execFileSync and spawn to control the Chrome browser and helper utilities like agent-browser.
[DYNAMIC_EXECUTION]: Scraping logic involves constructing JavaScript code strings at runtime and executing them within the browser context via the agent-browser tool to extract structured data from web pages.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to fetch and process data from external web novel platforms. This content is untrusted and could potentially contain malicious instructions intended to influence the agent's behavior.
Ingestion points: Scraper scripts (fanqie-rank-scraper.js, jjwxc-rank-scraper.js, qidian-rank-scraper.js, and qimao-rank-scraper.js) fetch content from various novel platforms.
Boundary markers: Output is delimited by Markdown headers and horizontal dividers in the generated reports.
Capability inventory: Shell command execution via agent-browser and local file system write access.
Sanitization: Content is cleaned of platform-specific boilerplate and truncated, but no comprehensive sanitization of the scraped text is performed.

abzu-scan