The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external websites (coupon aggregators, deal sites) via the agent's web-search tool. This represents an indirect prompt injection surface where a malicious site could attempt to embed instructions.
Ingestion points: Web search results from coupon sites and store pages.
Boundary markers: The skill explicitly instructs the agent to treat external content as data only, requires source links and dates for every code, and forbids the invention of codes.
Capability inventory: The skill uses a local Python script (scripts/rank_codes.py) for data processing; it does not perform network operations or file writes outside of the agent's native tools.
Sanitization: The instructions include a detailed "Scam-site red flags" rubric (Step 6) and an anti-fabrication rule (Step 0) specifically to filter out malicious or fake content from search results.
[DYNAMIC_EXECUTION]: The skill includes scripts/rank_codes.py, which is a utility script used to sort and format the gathered data.
Evidence: The script uses only Python standard libraries (argparse, json, sys) and performs simple lexical sorting and table rendering. It does not utilize eval(), exec(), or dynamic imports from untrusted paths.
[DATA_EXFILTRATION]: No exfiltration patterns were detected. While the skill methodology involves network access (via web search), it is used solely for information gathering. No sensitive file paths (e.g., .ssh, .aws) are targeted, and no hardcoded credentials or non-whitelisted exfiltration domains are present.

israeli-coupon-code-finder