The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The onboarding script contains a hardcoded base64-encoded identifier used for authentication requests.
Evidence: The variable _LOGIN_FIXED_UID in scripts/onboarding.py contains a static encoded string used in the uid header for login operations.
[INDIRECT_PROMPT_INJECTION]: The skill retrieves market data from external endpoints and presents it to the agent, creating a surface where untrusted data could influence agent behavior.
Ingestion points: scripts/sellersprite_market_research.py fetches data from vendor API endpoints.
Boundary markers: No specific delimiters are used to wrap the external content in the output to the agent.
Capability inventory: The skill allows file writing and execution of provided python scripts.
Sanitization: The skill does not sanitize the content of the API responses before display or storage.
[PERSISTENCE]: The onboarding documentation instructs users to manually modify their shell configuration files to store credentials.
Evidence: references/onboarding.md provides specific commands for users to append API keys to ~/.zshrc and ~/.bashrc files.

linkfox-sellersprite-market-research