The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes a standalone shell script (scripts/cookiy.sh) to interact with the Cookiy AI JSON-RPC API. It uses standard utilities like curl, jq, sed, and grep to perform study management, media uploads, and billing operations.
[EXTERNAL_DOWNLOADS]: The agent is instructed to fetch introductory content from the vendor's website at https://cookiy.ai/intro-for-agent.txt to supplement its knowledge of the platform.
[CREDENTIALS_UNSAFE]: The skill manages a service-specific access token stored at ~/.cookiy/token.txt. The provided script implements security best practices by enforcing restricted file permissions (chmod 600) on the credential file.
[DATA_EXFILTRATION]: Data related to user research (queries, study parameters, images) is sent to the vendor's API at s-api.cookiy.ai. This is the documented and primary purpose of the skill for users of the Cookiy service.
[PROMPT_INJECTION]: The skill includes an extensive qualitative synthesis pipeline (Phases 1-5). Like any tool that processes external data (such as interview transcripts), it possesses an indirect prompt injection surface where malicious instructions could be embedded in the processed materials. However, the instructions are structured for analysis rather than execution, which mitigates this risk.

user-research-cookiy