The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill demonstrates cross-process cookie sharing using the pickle module, which is inherently insecure for deserializing untrusted data.
Evidence: jar = pickle.load(f) in the Python example in SKILL.md.
Impact: If an attacker can modify the cookie file on disk, they can execute arbitrary code when the agent loads the session.
[DATA_EXPOSURE]: The skill suggests storing sensitive session cookies in a globally accessible temporary directory.
Evidence: with open('/tmp/shared_cookies.pkl', 'wb') as f: in SKILL.md.
Impact: Storing credentials or session tokens in /tmp on multi-user systems can lead to local credential exposure and session hijacking.
[INDIRECT_PROMPT_INJECTION]: The skill creates an attack surface by ingesting cookies from external browser contexts and websites.
Ingestion points: External cookies retrieved via context.cookies() in SKILL.md.
Boundary markers: Absent. There are no delimiters or instructions to treat cookie values as untrusted data.
Capability inventory: Network operations via httpx.Client in SKILL.md.
Sanitization: Absent. Values are transferred directly from the browser context to the HTTP client without validation or escaping.

httpx-session-cookies