The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local commands (via subprocess.run in Python and execFileSync in Node.js examples) to retrieve 2FA codes. This is a core functional requirement. The documentation correctly advises using argument arrays to prevent shell injection vulnerabilities.\n- [EXTERNAL_DOWNLOADS]: The scripts/preflight.py script performs a network request to https://www.cloudflare.com using urllib.request.urlopen to retrieve the Date header. This allows the skill to verify host clock synchronization, which is critical for TOTP code validity. This targets a well-known service for a specific diagnostic purpose.\n- [INDIRECT_PROMPT_INJECTION]: The skill operates on data from external web pages (identifying 2FA prompts). It proactively addresses risks where a malicious page might attempt to exfiltrate a code by instructing the agent to pin and verify the expected page origin before submitting any 2FA credentials.\n- [DYNAMIC_EXECUTION]: The scripts/preflight.py utility uses subprocess.run and shlex.split to dynamically execute and validate the output of user-supplied code commands. This execution is confined to the local environment and intended for pre-login verification.

login-2fa-flow