The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides complex JavaScript snippets intended for execution within the user's browser environment via the Chrome DevTools MCP. These scripts automate navigation, DOM interaction, and data extraction on Discord and X profile pages, performing actions within the context of the user's active login.
[DATA_EXFILTRATION]: The skill requires the agent to access and process sensitive session information, including CSRF tokens and Discord authorization headers, to facilitate requests to internal APIs. Although the instructions include safety rules to prevent exfiltration of these tokens, the capability to read and manipulate them creates a high-impact risk surface for credential theft or accidental exposure in logs. Additionally, the skill creates local JSON checkpoints containing aggregated member data, which could be exploited if the working environment is compromised.
[CREDENTIALS_UNSAFE]: The workflow explicitly instructs the agent to programmatically extract the X CSRF token from the browser's cookies and pass it in authenticated headers for internal API calls. Automated handling of live session credentials and security tokens is a high-risk pattern that can lead to session hijacking or account takeover if the agent's behavior is influenced by malicious input.

discord-x-follower-audit