The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to install a global Node.js package 'expect-cli' using npm install -g. This package is a third-party dependency not originating from an established trusted organization, posing a supply chain risk.
[REMOTE_CODE_EXECUTION]: By requiring the installation and execution of an external binary that processes complex instructions and controls a browser, the skill creates a path for remote code execution if the package or its remote resources are compromised.
[COMMAND_EXECUTION]: The skill's primary function is to execute shell commands (expect-cli -m "...") with user-supplied strings. This pattern is vulnerable to command injection if the input strings are not properly sanitized or if they contain malicious shell characters.
[DATA_EXFILTRATION]: The tool performs session recording (via rrweb) and supports 'cookie/auth injection'. Although the documentation claims data remains local, the tool communicates with an external host https://expect.dev for assets and uses PostHog for telemetry, creating potential pathways for sensitive session data or credentials to be transmitted externally.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted natural language instructions through the -m flag.
Ingestion points: The INSTRUCTION argument in expect-cli -m "INSTRUCTION".
Boundary markers: None; instructions are interpolated directly into the command string.
Capability inventory: Full browser automation, local file system access (via CLI), and network access (telemetry and replay host).
Sanitization: No evidence of input validation or escaping for the natural language instructions.

expect