The Agent Skills Directory

Indirect Prompt Injection Surface: The skill processes external data from websites via HAR files. Because this data is untrusted and used to derive the logic of a generated client, there is a potential surface for indirect prompt injection if a website provides malicious response bodies. The use of jq for extraction serves as a basic filter for this data.
Sensitive Data Management: The process of recording network traffic involves capturing headers, POST bodies, and cookies which may contain authentication secrets. The skill includes explicit warnings and instructions for the agent to treat these captures as secrets and to avoid hardcoding credentials into the final output.
Dynamic Execution of Generated Content: To verify the reverse-engineered client, the skill instructs the agent to execute the newly created script. This involves running code that was dynamically generated based on external observations, which is a necessary step for the skill's primary function but represents a dynamic execution pattern.

derive-client