The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted text from Amazon reviews which is then processed by the AI agent and exported to user-facing files. It proactively mitigates injection risks by sanitizing review bodies in scripts/build_review_delivery.py and scripts/export_reviews.py, where values starting with characters that could trigger spreadsheet formulas (=, +, -, @) are escaped with a single quote. This prevents malicious content in reviews from executing code when the resulting Excel file is opened by a user.
[COMMAND_EXECUTION]: Automated batch processing in scripts/batch_review_collect.py uses subprocess.run to call the internal scraper script. The arguments are securely handled: the ASIN is validated against a strict alphanumeric regex, the mode is restricted to a set of predefined choices, and the execution is explicitly tied to the current Python interpreter. This avoids arbitrary command injection.
[EXTERNAL_DOWNLOADS]: The skill retrieves review data from https://www.woot.com/review/Reviews/ and downloads associated review images via urllib.request. These targets are consistent with the skill's stated purpose of Amazon review analysis and target reputable domains.
[DYNAMIC_EXECUTION]: The skill includes scripts/local_json_receiver.py, which sets up a local HTTP listener on port 8765 to receive data from browser-based captures. To ensure security, it strictly sanitizes the filenames and subdirectory names derived from the received JSON payload to prevent directory traversal or unauthorized file system access.

amazon-review-scraper