The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses Python's subprocess.run and Node's child_process.spawn to manage its internal workflows. In scripts/cli2anything.py, it executes the bundled Node.js entry point without shell evaluation. In bin/cli2anything.mjs, it uses system commands to open browser windows or link local packages, which are standard operations for a CLI development tool.
[DYNAMIC_EXECUTION]: The skill utilizes the Chrome DevTools Protocol (CDP) in src/browser-cdp.mjs to evaluate JavaScript functions within a browser tab. This is used to perform same-origin fetch requests, allowing the tool to reuse a user's existing login sessions for API discovery without requiring manual credential input.
[DATA_EXFILTRATION]: While the skill is designed to capture network traffic, it includes explicit security controls in src/json-shape.mjs to redact sensitive headers like Authorization and Cookie before data is saved or displayed. This prevents accidental exposure of authentication secrets during the discovery process.
[INDIRECT_PROMPT_INJECTION]: The skill handles external data from API responses and discovery files. It implements a defensive posture by defining a safety policy in src/api-graph.mjs that identifies and restricts dangerous operations (e.g., 'delete', 'remove', 'cancel') within the generated API maps.

lov-cli2anything