The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data by scraping content from 27 different Brazilian government websites.
Ingestion points: Data is fetched from state-level Juntas Comerciais (e.g., jucerja.rj.gov.br, jucesp.sp.gov.br) using httpx and Playwright browsers.
Boundary markers: Scraped data is parsed directly into structured formats without the use of delimiters or specific instructions to the agent to ignore embedded commands.
Capability inventory: Across its scripts, the skill can write to a local SQLite database (scripts/db.py), create JSON and CSV exports (scripts/export.py), serve data via a FastAPI web server (scripts/serve_api.py), and execute local Python scripts via subprocess calls (scripts/web_scraper_fallback.py).
Sanitization: The author has implemented proactive security measures: safe_user_path is used to prevent path traversal vulnerabilities during file exports, and spreadsheet_safe_cell neutralizes potential CSV formula injection (CSV injection) in generated reports.
[COMMAND_EXECUTION]: The skill includes a fallback mechanism that executes a local Python script from a separate directory using the subprocess module.
Evidence: In scripts/web_scraper_fallback.py, the skill executes a script located at C:\Users\renat\skills\web-scraper\scripts\scrape.py.
Context: The execution is performed safely using a list of arguments (avoiding shell invocation), and the inputs passed to the script are hardcoded URLs from the scraper's configuration.
[DYNAMIC_EXECUTION]: The skill dynamically modifies the Python path to manage local module dependencies and invokes an external script at runtime.
Evidence: Extensive use of sys.path.insert(0, ...) to resolve internal script paths and the invocation of the web-scraper skill via subprocess.run as a fallback strategy for failed extractions.

junta-leiloeiros