The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill saves Zomato session cookies to /tmp/zomato-cookies.json. These cookies represent sensitive authentication tokens that allow access to the user's account without requiring a password or OTP. Storing these tokens in the /tmp directory is an insecure practice, as it is a globally predictable location that may be accessible to other processes or users depending on the host system's configuration.
[COMMAND_EXECUTION]: The skill executes local Node.js scripts using node scripts/zomato-order.js to handle browser automation. This interaction involves executing code that controls a browser session to perform actions on the Zomato website.
[EXTERNAL_DOWNLOADS]: The skill documentation requires the installation of the playwright package and the Chromium browser (npx playwright install chromium). While these are standard tools for browser automation, they involve downloading external binaries.
[DATA_EXFILTRATION]: The skill captures sensitive transaction information, including the Zomato payment link and state screenshots, and stores them in the temporary directory (/tmp/zomato-payment-link.txt and /tmp/zomato-state.png). This increases the local attack surface for exposure of sensitive user data.

zomato-order