The Agent Skills Directory

[DATA_EXFILTRATION]: The skill accesses and clones the user's browser profile directory to a local hidden folder.
Evidence: config.ts and browser.ts detect the user's browser profile (e.g., ~/Library/Application Support/Google/Chrome) and use fs.cpSync to duplicate it to ~/.lbc-scraper/profile. This profile includes highly sensitive data such as session cookies, browsing history, and potentially stored credentials.
[COMMAND_EXECUTION]: Spawns browser binaries as child processes with specific debugging flags.
Evidence: browser.ts uses child_process.spawn to launch Chrome, Brave, or Chromium with the --remote-debugging-port and --user-data-dir flags. This enables the skill to control the browser instance programmatically.
[DYNAMIC_EXECUTION]: Executes dynamically constructed JavaScript snippets directly in the browser's execution context.
Evidence: The skill extensively uses the Runtime.evaluate CDP command in deposit-form.ts, auth.ts, and scraper.ts to interact with the DOM, fill forms, and extract Next.js page data. This bypasses standard automation detection but allows for arbitrary code execution within the user's logged-in session.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data from web pages and local files to drive automated browser actions, creating an injection surface.
Ingestion points: Ingests structured data from Leboncoin's __NEXT_DATA__ script tags in scraper.ts and parses user-supplied content from annonce.md in markdown.ts.
Boundary markers: Absent. The skill does not use specific delimiters or instructions to ignore potential injection markers in the ingested listing data.
Capability inventory: Includes browser binary execution (browser.ts), full DOM control and form submission (publish.ts), and file system writes (markdown.ts).
Sanitization: Absent. Data extracted from comparable listings is formatted into markdown and re-ingested without explicit sanitization against prompt-based attacks.

leboncoin