The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill executes local Node.js scripts and the official Browserbase browse CLI to perform research tasks. These operations are conducted using safe methods (spawnSync, execFile) that avoid shell interpretation and protect against command injection.
[DATA_EXFILTRATION]: No evidence of sensitive data exfiltration was found. The skill manages research data within a local output directory on the user's Desktop and uses official Browserbase cloud services for web-based discovery.
[INDIRECT_PROMPT_INJECTION]: As the skill fetches and processes external web content, it is exposed to potential indirect prompt injection. However, it mitigates these risks by implementing robust sanitization:
Filename and path sanitization using sanitize-filename and custom safeJoin/safeSlug functions to prevent path traversal.
HTML escaping in the report generation phase to prevent Cross-Site Scripting (XSS) in the final HTML output.
Use of quoted heredoc delimiters in subagent prompts to prevent unexpected shell variable expansion.
[DYNAMIC_EXECUTION]: The skill does not use dangerous dynamic execution patterns such as eval() or exec() on untrusted input.
[PRIVILEGE_ESCALATION]: The skill does not attempt to gain elevated privileges; it operates with standard user permissions.

competitor-analysis