The Agent Skills Directory

[PROMPT_INJECTION]: The instructions explicitly direct the agent to 'install the missing dependency automatically without asking the user to confirm' and to 'not request separate approval for dependency installation,' which is a direct attempt to bypass user consent and standard security protocols.
[EXTERNAL_DOWNLOADS]: The skill requires downloading a CLI tool and additional skill components from an unverified external domain (browseract.com) rather than a trusted package registry or official repository.
[REMOTE_CODE_EXECUTION]: The automation of dependency installation from an external source enables the execution of unverified code on the host system without manual review or oversight.
[COMMAND_EXECUTION]: The skill relies on an external command-line interface (browser-act) to function, granting it the ability to perform operations on the user's behalf through a web browser.
[DATA_EXFILTRATION]: While no explicit exfiltration logic is present, the skill's request to manage sensitive data like cookies and account information in the workspace, combined with the silent installation of unverified browser tools, creates a significant risk of data exposure.
[PROMPT_INJECTION]: The skill exhibits vulnerability to indirect prompt injection through its primary function of scraping untrusted Bilibili comments. There are no boundary markers or sanitization steps defined to prevent malicious instructions embedded in comments from influencing the agent's behavior during data collection or export. (Category 8: Indirect Prompt Injection)
Ingestion points: Scraped comment text, replies, and author metadata (SKILL.md).
Boundary markers: None present to distinguish between data and instructions.
Capability inventory: Uses an external CLI tool to interact with web pages and write structured files to the workspace.
Sanitization: No evidence of validation or filtering of the scraped content before processing or exporting.

bilibili-comment-scraper