The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill injects and executes arbitrary JavaScript into a running Google Chrome instance using the AppleScript execute javascript command. This allows the agent to run code in the context of reddit.com with the user's active session and cookies.
[DYNAMIC_EXECUTION]: The skill employs a secondary method involving UI automation where it copies JavaScript to the system clipboard and uses System Events to automate keystrokes (Cmd+Option+J, Cmd+V, Enter) to paste and execute code directly in the Chrome Developer Tools console.
[PRIVILEGE_ESCALATION]: The skill bypasses browser security controls, such as the Same-Origin Policy (CORS) and authentication requirements, by executing scripts within a session where the user is already logged in. It also leverages macOS System Events for UI automation, a capability that typically requires specific system-level Accessibility permissions.
[COMMAND_EXECUTION]: The skill frequently executes shell commands via osascript to control the operating system and other applications (Google Chrome and System Events), as seen in the navigation and execution logic in SKILL.md.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data that could contain malicious instructions.
Ingestion points: The skill fetches Reddit post data via fetch("/r/SideProject/rising.json?limit=10") in SKILL.md.
Boundary markers: Absent; there are no delimiters or instructions to ignore embedded content when processing post data.
Capability inventory: The skill has the ability to execute shell commands (osascript), execute JavaScript in the browser, manipulate the system clipboard (pbcopy), and post comments back to Reddit.
Sanitization: Absent; the skill does not specify any sanitization or escaping of the fetched Reddit content before it is processed by the agent to draft comments.

reddit-cultivate