The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill contains sophisticated modules to extract authentication cookies (e.g., auth_token, ct0) from browser databases including Chrome, Firefox, Brave, and Safari.
Found in scripts/lib/cookie_extract.py, scripts/lib/chrome_cookies.py, and scripts/lib/safari_cookies.py.
It can also read live session data over the Chrome DevTools Protocol (CDP) as implemented in scripts/lib/chrome_cdp.py.
These credentials are used to authenticate to platforms like X/Twitter for search operations.
[EXTERNAL_DOWNLOADS]: The setup wizard and various scripts initiate downloads of external tools and libraries.
scripts/lib/setup_wizard.py attempts to install yt-dlp using Homebrew.
It uses npx to install Printing Press CLIs from the @mvanhorn/printing-press-library npm package.
[COMMAND_EXECUTION]: The engine relies heavily on shelling out to external binaries to perform its research tasks.
Utilities invoked include gh, yt-dlp, grok, npx, pdftotext, and several specialized Printing Press CLIs (arxiv-pp-cli, digg-pp-cli, etc.).
[REMOTE_CODE_EXECUTION]: The skill references and recommends running remote installation scripts.
Automated scans detected patterns recommending curl -fsSL https://x.ai/cli/install.sh | bash for the Grok CLI.
The use of npx -y ... install dynamically downloads and executes code from the npm registry at runtime.
[DATA_EXFILTRATION]: While intended for research, the skill reads sensitive data (browser cookies) and sends them to third-party endpoints (X/Twitter, Truth Social) for authentication.
It also includes a corpus source (scripts/lib/corpus.py) that can read content from local directories specified by the user.
[PROMPT_INJECTION]: The skill provides instructions to the agent to treat fetched content as data and ignore any embedded instructions (Category 8b protection).
However, the complex output contract includes instructions to conceal certain internal behaviors and meta-commentary from the final user response, which is flagged as a concealment pattern.

last30days