The Agent Skills Directory

[COMMAND_EXECUTION]: The main Python script scripts/extract_commenters.py invokes a local Node.js script using subprocess.run(). The command arguments are passed as a list, which prevents shell injection vulnerabilities.
[EXTERNAL_DOWNLOADS]: The skill fetches data from the Apify API (api.apify.com) and utilizes the Playwright library, which may download browser binaries. Both are well-known and legitimate services for web automation.
[CREDENTIALS_UNSAFE]: The skill requires a LinkedIn session cookie (li_at) for authentication in its scraping mode. While documented as an environment variable, handling session cookies involves security risks if the local environment is compromised.
[PROMPT_INJECTION]: The skill ingests user-generated content from LinkedIn (names, headlines, and comments). This creates a surface for indirect prompt injection if the data is subsequently processed by an LLM without sanitization.
Ingestion points: LinkedIn post comments harvested in scripts/li_comments_playwright.mjs.
Boundary markers: Not present in the JSON or CSV output fields.
Capability inventory: Shell execution via subprocess.run and network requests via urllib.request in the Python script.
Sanitization: No specific filtering or escaping for LLM instructions is performed on the extracted text.

linkedin-commenter-extractor