The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from Product Hunt (names, taglines, and descriptions) and reflects it into the agent's context without sanitization.
Ingestion points: scripts/scrape_producthunt.py fetches product data from the Apify dataset API.
Boundary markers: The output (JSON or text summary) does not use clear delimiters or warnings to isolate external content from instructions.
Capability inventory: The script uses the requests library to perform network operations and outputs data to stdout for the agent to consume.
Sanitization: No filtering, escaping, or validation is performed on the scraped product text before outputting.
[CREDENTIALS_UNSAFE]: The script transmits the API token as a URL query parameter (params={"token": token}) when communicating with the vendor's proxy endpoint (app.gooseworks.ai). This is a security anti-pattern as it exposes sensitive credentials in server access logs and telemetry.
[EXTERNAL_DOWNLOADS]: The skill requires the installation of the third-party requests library via pip, which is a standard dependency but involves downloading code from an external registry (PyPI).

product-hunt-scraper