The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill performs automated network requests to fetch metadata and images from trusted domains, specifically itunes.apple.com, apps.apple.com, is1-ssl.mzstatic.com, and play.google.com. These operations are required for the skill's primary research and analysis functionality.
[COMMAND_EXECUTION]: Several utility scripts (build_catalog.py, evidence.py, prepare_screens.py) invoke the external tesseract OCR engine via subprocess.run to extract text from images. These calls use temporary files and specific language parameters, following safe execution patterns for local tool integration.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface where malicious instructions could be embedded in external data that the agent is instructed to process. Specifically, descriptions fetched from app store listings or content retrieved from an app's website could contain prompt injection attempts aimed at influencing the agent's design or writing tasks.
Ingestion points: fetch_listing.py (reads store description and release notes), dna.py (fetches and parses website HTML/CSS), and evidence.py (processes OCR text from app screens).
Boundary markers: Absent; the instructions do not specify strict delimiters for external content within the context.
Capability inventory: The skill possesses file-write capabilities (saving screenshots and manifests), network access, and subprocess execution.
Sanitization: fetch_listing.py performs basic HTML tag removal using regular expressions, but does not sanitize potential natural language instructions.

store-screenshots