The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from live Amazon search results and product pages. This data, including product titles and descriptions, is subsequently embedded into HTML reports (report.html) via a template replacement mechanism that uses JSON.stringify within a <script> tag. This approach fails to sanitize for HTML-sensitive sequences like </script>, which could allow a malicious product listing to execute arbitrary JavaScript when the report is viewed.
Ingestion points: Data fetched from Amazon search and product pages via the built-in browser as specified in SKILL.md and references/asin-visibility-auditor.md.
Boundary markers: No specific delimiters or warnings to ignore embedded instructions are provided in the prompts for data collection.
Capability inventory: The skill uses fs.writeFileSync within its scripts to generate the final reports and utilizes sub-agent spawning for task delegation.
Sanitization: While JSON.stringify is used, it is insufficient for preventing script breakout in HTML contexts.
[COMMAND_EXECUTION]: The skill instructs the agent to use local command-line execution for utility tasks.
Evidence: SKILL.md step 9 explicitly directs the agent to use node -e to perform URL encoding for search terms.
[DYNAMIC_EXECUTION]: The skill performs dynamic generation of executable content by injecting data into HTML/JavaScript templates at runtime.
Evidence: scripts/render-asin-report.js and scripts/render-dashboard.js assemble the final report by replacing a placeholder in the HTML templates with a JSON-serialized string of collected data.
[EXTERNAL_DOWNLOADS]: The skill's report templates reference resources from well-known services.
Evidence: references/asin-report-template.html and references/dashboard-template.html fetch the React library from unpkg.com and typography from fonts.googleapis.com. These are recognized well-known technology services and are documented neutrally.

amazon-asin-search-auditor