The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads and installs the Playwright browser automation framework and its associated Chromium engine. These are standard developer tools and originate from well-known, trusted sources.
[CREDENTIALS_UNSAFE]: The skill captures and manages sensitive Amazon session cookies to maintain login state. Security risks are mitigated by storing these credentials locally at ~/.mercury/amazon/cookies.json with restricted file permissions (chmod 600), ensuring only the current user can access them.
[DATA_EXFILTRATION]: No patterns were detected that suggest sensitive account data or cookies are transmitted to any external servers other than official Amazon domains during standard operations.
[COMMAND_EXECUTION]: The script uses Playwright to launch a visible or headless Chromium browser to perform shopping tasks. This is the intended primary purpose of the skill and does not involve arbitrary shell command execution.
[INDIRECT_PROMPT_INJECTION]: The skill reads product titles, prices, and reviews from Amazon's website. While this ingests untrusted third-party content, the risk of indirect prompt injection is minimized by the skill's structure, which uses specific CSS selectors to extract data and presents it to the agent without granting it execution privileges.

amazon-assistant