The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The script scripts/umami-report.ts includes a hardcoded token value for UMAMI_SHARE_ID ("GRVFnQSQSLlfRjCa"). This token is used to authenticate requests to the Umami Analytics API as a fallback if no environment variable is provided.
[DATA_EXFILTRATION]: The skill performs outbound network requests to https://umami.lsd.sk to retrieve site analytics data.
[DATA_EXFILTRATION]: The utility scripts/health-score.ts crawls the website www.teamday.ai (the vendor's domain) by fetching sitemaps and individual page content to analyze SEO health.
[COMMAND_EXECUTION]: The audit script scripts/health-score.ts executes the shell command find via Bun's execSync to locate and list HTML files on the local filesystem.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface in scripts/health-score.ts which ingests and parses untrusted HTML content from the web.
Ingestion points: External HTML content fetched from URLs in the sitemap.
Boundary markers: Absent; the parsed data is presented to the agent without delimiters.
Capability inventory: The skill has access to Bash and Write tools.
Sanitization: Absent; the script extracts text from tags via regular expressions without sanitization.

seo