The Agent Skills Directory

[DATA_EXFILTRATION]: The /browser-cdp command and the associated documentation encourage users to expose their browser to the agent using the Chrome DevTools Protocol (--remote-debugging-port=9222). The skill explicitly states it "reuses existing browser login session via CDP protocol" to scrape data. This capability allows the agent to access and exfiltrate sensitive information, such as session cookies, private messages, or account data, from any website where the user is currently logged in.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from various external and untrusted sources, creating a vulnerability surface where malicious instructions could be embedded in novel content or scraped web pages.
Ingestion points: Market ranking data from platforms like 起点 (Qidian) and 番茄 (Fanqie) via /browser-cdp, and user-provided chapter files in the 正文/ directory.
Boundary markers: The instructions do not define delimiters or warnings to ignore embedded instructions in the scraped or read content.
Capability inventory: The agent is granted powerful capabilities including full browser automation (via CDP), shell script execution (via init_novel.sh, deslop_batch.sh), and extensive file system read/write access.
Sanitization: There is no evidence of sanitization or validation of the content ingested from external websites or user files before it is processed by the agent.
[COMMAND_EXECUTION]: The skill provides several shell scripts (init_novel.sh, deslop_batch.sh, wordcount.sh) that are intended to be executed by the agent to manage the filesystem and process batches of files. While these scripts perform the tasks described, they establish a pattern of the agent executing local shell commands to modify the user's environment.

oh-story-claudecode-writing