The Agent Skills Directory

[CREDENTIALS_UNSAFE]: A hardcoded bearer token (sk-dev-proxy-123) is present in the review.py script. Although it appears to be a placeholder for local development, it follows the pattern of an unsafe hardcoded credential.
[REMOTE_CODE_EXECUTION]: The cdp_client.py script automatically installs missing Python dependencies (websocket-client, httpx) at runtime using pip install without specifying versions, which is a risk for supply-chain attacks.
[COMMAND_EXECUTION]: The scripts/lib/anti_avoidance_gate.py script executes arbitrary shell commands using subprocess.run(..., shell=True) based on commands defined in a JSON configuration file. This represents a significant execution capability that could be abused if the configuration is controlled by an attacker.
[EXTERNAL_DOWNLOADS]: The skill performs several external downloads, including npm install for its vendored CLI tool in scripts/ensure-surf-cli.sh and a git clone operation in scripts/live_cdp_pointer_example.py to fetch a bot-detection research repository.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from arbitrary web pages and process it through AI agents. This creates a wide attack surface for indirect prompt injection where hidden instructions on a webpage could attempt to hijack the agent's behavior or leverage the skill's powerful browser-control capabilities.

surf