The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill uses npx unclaimed in Step 4 to perform bulk domain availability checks across multiple TLDs. This command downloads and executes the unclaimed package from the npm registry at runtime without a pinned version or integrity verification.
[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection because it fetches and processes data from external, untrusted websites.
Ingestion points: In Step 7a, the skill uses curl to fetch the first 16KB of content from arbitrary candidate domains to perform a liveness probe. In Step 10a, it uses agent-browser to extract text from the USPTO trademark search interface.
Boundary markers: The instructions do not implement boundary markers or specific delimiters to isolate this external content from the agent's core instructions.
Capability inventory: The skill possesses powerful capabilities, including the ability to initiate domain purchases (vercel domains buy), execute shell commands (npm install, brew install), and make authenticated API calls to registrar services like Namecheap.
Sanitization: There is no evidence of sanitization, filtering, or escaping of the content fetched from the web before it is analyzed by the agent.
[EXTERNAL_DOWNLOADS]: The skill requires the installation of external dependencies, including the Vercel CLI (npm i -g vercel) and WHOIS utilities (brew install whois). While Vercel is a well-known service, these installations involve fetching code from remote repositories at runtime.

domain