The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches its core application logic and environment from an unverified GitHub repository (https://github.com/ZRainbow1275/AutoTeam-F.git). This source is not categorized as a trusted organization.
[REMOTE_CODE_EXECUTION]: Instructs users to run a shell script (setup.sh) and use the uv package manager to sync dependencies from the untrusted repository. This pattern allows for the execution of arbitrary remote code on the host system.
[COMMAND_EXECUTION]: The installation process involves executing shell commands to clone repositories, run setup scripts, and install browser binaries (playwright install chromium), which could be leveraged for malicious purposes by the remote script author.
[DYNAMIC_EXECUTION]: Uses Playwright for browser automation and FastAPI for a local web server. The tool also supports building Docker containers from a remote Dockerfile, which involves runtime compilation and environment creation from unverified sources.
[INDIRECT_PROMPT_INJECTION]: The skill serves as a high-privilege surface that processes untrusted data from external sources.
Ingestion points: Data is ingested from temporary mail providers (cf_temp_email, maillab), OAuth callback URLs, and manual account addition inputs.
Boundary markers: No explicit boundary markers or "ignore embedded instructions" warnings are documented for the processing of external API responses or mailbox content.
Capability inventory: The skill possesses significant capabilities, including persistent file system writes (accounts.json, register_failures.json), full network access via httpx, and browser automation through Playwright.
Sanitization: There is no evidence of sanitization or validation logic for data received from external mail backends or OAuth redirection URLs.

autoteam-f-chatgpt-team-rotation