The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill contains complex logic in scripts/lib/env.py and scripts/lib/cookie_extract.py to access and read local browser cookie databases (Firefox, Chrome, Brave, and Safari). It extracts session tokens for X/Twitter and Truth Social. While this is used for zero-config authentication, accessing local browser data is a significant privacy and security concern.
[COMMAND_EXECUTION]: The skill extensively uses the subprocess module to run external binaries. Notable examples include:
scripts/lib/youtube_yt.py executes yt-dlp commands and supports routing them through a remote host via ssh based on the LAST30DAYS_YOUTUBE_SSH_HOST environment variable.
scripts/lib/bird_x.py invokes node to run a vendored JavaScript search component.
scripts/watchlist.py and scripts/verify_v3.py spawn additional Python subprocesses to manage background tasks and run tests.
[INDIRECT_PROMPT_INJECTION]: The skill's primary purpose is to aggregate data from untrusted sources like Reddit, X, YouTube transcripts, and TikTok captions. This ingestion surface is large, and malicious instructions embedded in these external sources could attempt to influence the agent's behavior during synthesis.
[DYNAMIC_EXECUTION]: The skill uses importlib and dynamic import() in its JavaScript components (e.g., scripts/lib/vendor/bird-search/lib/cookies.js dynamically loading @steipete/sweet-cookie). Additionally, the agent is instructed to generate JSON query plans at runtime and write them to temporary files which are then executed by the system.
[EXTERNAL_DOWNLOADS]: The skill interacts with numerous external APIs to fetch data, including api.scrapecreators.com, api.x.ai, openrouter.ai, hn.algolia.com, and gamma-api.polymarket.com.
[PRIVILEGE_ESCALATION]: The setup wizard in scripts/lib/setup_wizard.py attempts to install the yt-dlp utility using Homebrew (brew install) if it is not already present on the system.

last30days