The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill configuration examples include a hardcoded API key pattern (sk-or-v1-...) for the OpenRouter provider.
[PRIVILEGE_ESCALATION]: The documentation explicitly instructs the user to set the environment variable SKIP_PERMISSIONS=1 to bypass security prompts and permission checks during the agent's autonomous operation.
[COMMAND_EXECUTION]: The skill's workflow executor scripts (e.g., workflows/executors/linkedin-engagement.ts) utilize execSync to perform shell operations. These scripts interpolate variables derived from scraped web content without sanitization, creating a high risk of command injection.
[REMOTE_CODE_EXECUTION]: The skill directs users to clone and run code from an unverified GitHub repository (LocoreMind/locoagent) as part of the setup process.
[EXTERNAL_DOWNLOADS]: The installation instructions fetch the Bun runtime via a piped shell command (curl | bash) and install the @vercel/agent-browser utility. Bun is a well-known service, and Vercel is a trusted organization.
[INDIRECT_PROMPT_INJECTION]: The skill exposes a significant attack surface by ingesting and acting upon untrusted data from social media platforms.
Ingestion points: The skill uses agent-browser snapshot to capture data from X.com and LinkedIn feeds in workflows/executors/linkedin-engagement.ts and related scripts.
Boundary markers: No boundary markers or instructions to ignore embedded content were found; the scripts process raw JSON attributes directly.
Capability inventory: The skill has access to execSync for shell execution and utilizes the agent-browser tool for complex web interactions.
Sanitization: Attributes scraped from web elements (such as data-urn or URN-based URLs) are interpolated directly into shell command strings without escaping, allowing for remote code execution if a scraped element contains malicious payloads.

locoagent-social-media-automation