The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The scripts/setup.sh wrapper downloads a script from the author's GitHub repository (https://raw.githubusercontent.com/FinpeakInc/frevana-cli-releases/refs/heads/main/skills/frevana/scripts/setup.sh).
[REMOTE_CODE_EXECUTION]: The skill executes the downloaded setup script using bash to prepare the local environment.
[COMMAND_EXECUTION]: The script get_amazon_top_reviews.sh executes several system-level operations:
Spawns a local frevana binary to perform the review retrieval.
Uses python3 to dynamically generate and format JSON payloads.
Invokes curl for health checks and external script downloads.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its processing of external web content.
Ingestion points: Untrusted data enters the agent context via the --url argument which points to Amazon product pages (processed in get_amazon_top_reviews.sh).
Boundary markers: The URL is encapsulated within a JSON object passed to the frevana_ask tool, providing some structure but no explicit 'ignore instructions' delimiters.
Capability inventory: The skill can execute shell commands (bash), local binaries (frevana), and network requests (curl).
Sanitization: The skill employs a regular expression in get_amazon_top_reviews.sh to ensure the input URL strictly matches the Amazon product URL format (/dp/ or /gp/product/ with a 10-character ASIN).

amazon-top-reviews