The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes subprocess.run within scripts/_shopee_global_product_common.py to execute a local verification script (check_auth_dependency.py). This is a legitimate implementation to ensure required sibling skills are installed in the environment.
[PERSISTENCE]: Documentation in references/onboarding.md provides instructions for users to manually add environment variables to their shell profile files (e.g., .bashrc, .zshrc). These instructions are user-facing and serve to persist authentication keys for the tool's functionality.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests untrusted data from the Shopee API.
Ingestion points: Data enters the system via API responses fetched in scripts/_global_product_api_runner.py.
Boundary markers: The skill does not implement explicit text-based boundary markers in its instructions, although it encourages the use of jq to scope data access.
Capability inventory: The skill has the capability to write files to the local project directory via emit_result and perform network operations via urllib.
Sanitization: Responses are serialized using standard json.dumps before being presented to the agent, reducing the risk of control character injection.

linkfox-shopee-store-global-product