The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill includes an installation command that downloads and executes a shell script directly from the author's GitHub repository: curl -fsSL https://raw.githubusercontent.com/vaayne/tap/main/scripts/install.sh | sh. While this is a vendor-owned resource, executing remote content via shell is a sensitive operation.
[DATA_EXFILTRATION]: The skill exposes commands to extract sensitive browser session data, such as tap browser cookies get, tap browser storage local, and tap browser state save <path>, which can be used to access user authentication tokens.
[COMMAND_EXECUTION]: The skill operates by executing the tap command-line interface to perform all browser automation, network capture, and configuration management tasks.
[EXTERNAL_DOWNLOADS]: References an external repository (github.com/epiral/bb-sites) for site-specific extraction scripts used by the tool.
[PROMPT_INJECTION]: Content fetched from the web via tap fetch or tap browser text is ingested into the agent context, creating a surface for indirect prompt injection. Ingestion points: Web content and network responses fetched via the CLI. Boundary markers: None identified. Capability inventory: JavaScript execution via tap browser evaluate, cookie extraction, and local file access. Sanitization: No documented sanitization or filtering of external content.

tap-web