The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The script scripts/_navos_balance.mjs contains a hardcoded authentication token (ext_bq_2H9aLpQz6mKvR3sN) used in the X-Cm-Admin-Auth header for balance query operations against the vendor's API.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-generated content from external platforms.
Ingestion points: Influencer biographies (bio) and hashtags (hashtags) are retrieved via scripts/search_creators.mjs and scripts/get_task_data.mjs.
Boundary markers: No explicit markers or 'ignore' instructions are provided when this content is passed to the agent's context.
Capability inventory: The skill possesses capabilities for network operations (fetch in _api_client.mjs), file writing (writeFileSync in export_to_csv.mjs), and process execution (spawnSync in _api_client.mjs).
Sanitization: Content is only processed for Markdown table alignment; no instruction filtering is performed on retrieved metadata.
[EXTERNAL_DOWNLOADS]: The scripts/skill_update.mjs component implements a self-update feature that fetches and mirrors the skill's source code from the vendor's GitHub repository (raw.githubusercontent.com/creativault/skills/).
[DATA_EXFILTRATION]: The scripts/media_upload.mjs utility reads local files and transmits them to external infrastructure (oss.creativault.tech). While logic exists to restrict uploads to common video formats, this allows for the externalization of local files.
[COMMAND_EXECUTION]: The skill uses node:child_process (spawnSync) to execute its internal maintenance scripts during update cycles.
[DATA_EXPOSURE]: An automated scanner flagged https://your-api-host.com as malicious. Security review confirms this is a benign placeholder string used in a console.error hint to guide users on setting up environment variables.

creator-scraper-cv