The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The script scripts/scrape_reviews.py handles the GOOSEWORKS_API_KEY (and APIFY_API_TOKEN) securely within the environment, but it transmits these credentials as URL query parameters (params={"token": token}) when making requests to the API proxy. Credentials passed in query strings are often captured in server access logs, proxy logs, and browser history, which is an insecure transmission method compared to using HTTP headers.
[PROMPT_INJECTION]: The skill facilitates indirect prompt injection by fetching untrusted text from third-party review platforms (G2, Capterra, Trustpilot). This content is provided to the agent without sanitization.
Ingestion points: Data is fetched in scripts/scrape_reviews.py via the run_apify_actor function and returned to the agent context.
Boundary markers: The skill does not provide clear delimiters or instructions to the agent to treat the review text as untrusted or to ignore any instructions embedded within it.
Capability inventory: The skill has network access capabilities via the requests library.
Sanitization: No sanitization or filtering of potential injection strings is performed on the review body text (text, pros, cons) before it is processed by the agent.

review-scraper