The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes multiple shell commands to manage configuration and run analysis. These include cat to check for configuration files, echo to update environment variables, and node to verify the presence of API keys. The node -e command executes a script at runtime for environment verification.\n- [REMOTE_CODE_EXECUTION]: The skill uses npx goose-aeo@latest to run an external CLI tool. This pattern downloads and executes code from the npm registry. As this is a vendor-owned resource, it is considered intended functionality.\n- [EXTERNAL_DOWNLOADS]: The skill fetches the goose-aeo package from the npm registry using the npx command.\n- [DATA_EXFILTRATION]: The skill transmits brand-related data, such as domains and competitor lists, to external AI service providers (including OpenAI, Perplexity, Gemini, Grok, Claude, and DeepSeek) to perform visibility analysis.\n- [CREDENTIALS_UNSAFE]: The skill prompts users for API keys for various AI providers and stores them in a local .env file. This follows standard development practices for secret management but involves the handling of sensitive credentials.\n- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it performs website audits, which involves ingesting untrusted content from external URLs. \n
Ingestion points: The npx goose-aeo@latest audit command in SKILL.md scrapes website pages.\n
Boundary markers: The skill does not define delimiters or warnings to ignore instructions embedded in the scraped content.\n
Capability inventory: The agent can execute shell commands (npx, cat, echo) and read/write local files.\n
Sanitization: There is no description of sanitization or filtering for external content.

aeo