The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses spawnSync in its Node.js script to execute a local tool named opencli. This is an intended integration for the skill's purpose of fetching platform data. The arguments passed to the command are strictly controlled via a hardcoded map of source definitions, preventing arbitrary command injection.
[REMOTE_CODE_EXECUTION]: The skill includes instructions to run a local JavaScript file using node. This script performs network requests via fetch() to a specific domain (aihot.virxact.com) and executes the opencli command. The execution is scoped to the skill's own directory and does not download or execute untrusted remote code.
[DATA_EXFILTRATION]: While the skill accesses external trend signals, it does not access sensitive system files or credentials. Network activity is limited to fetching public trend data. The instructions explicitly forbid installing new browsers, crawlers, or third-party runtimes.

laohan-redian