The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill generates and executes JavaScript at runtime by interpolating user-provided parameters (such as search keywords, sort orders, and database selections) into a predefined script template executed via evaluate_script.- [CREDENTIALS_UNSAFE]: The skill programmatically scrapes the Web of Science session identifier (SID) from the browser's internal performance resource metrics (performance.getEntriesByType('resource')) to authenticate subsequent API requests.- [COMMAND_EXECUTION]: Includes instructions to modify the browser's navigator.webdriver property to mask automation signatures and evade anti-bot detection systems during fallback navigation.- [INDIRECT_PROMPT_INJECTION]:
Ingestion points: Accepts unvalidated search keywords directly from the user.
Boundary markers: The skill does not implement boundary markers or instructions to ignore embedded commands within the search keywords.
Capability inventory: The skill has the capability to execute arbitrary JavaScript in the browser context and perform network fetches to the host domain.
Sanitization: There is no logic provided to sanitize or escape user-provided keywords before they are interpolated into the {QUERY_ROWS} placeholder in the script template.- [SAFE]: All network operations and navigations are restricted to the official Web of Science domain (webofscience.com), and no evidence of data exfiltration to third-party domains was found.

wos-search