The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/cdp-utils.js utility uses child_process.execFileSync to invoke the agent-browser command-line tool, which is required for browser-based data collection.
[DYNAMIC_EXECUTION]: The scraping scripts (dz-browse-scraper.js and heiyan-booklist-scraper.js) use the Chrome DevTools Protocol (CDP) to execute dynamically generated JavaScript within the browser environment for data extraction and page interaction.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from external story platforms, which presents a surface for indirect prompt injection if those platforms contain malicious instructions targeting the agent.
Ingestion points: dz-browse-scraper.js and heiyan-booklist-scraper.js capture story titles, descriptions, and metadata from platform pages (ishugui.com, zhangwenpindu.cn).
Boundary markers: None; scraped content is interpolated directly into the market reports.
Capability inventory: The skill possesses file writing capabilities (fs.writeFileSync) and command execution via agent-browser.
Sanitization: No explicit sanitization or filtering of the scraped text was identified.
[CREDENTIALS_UNSAFE]: The script scripts/heiyan-booklist-scraper.js programmatically reads document.cookie to extract an Admin-Token. While this is used locally to authenticate the scraper's requests to the platform's official API, it represents an automated session token handling pattern.

story-short-scan