The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill is designed to automatically search for and parse a file named .credentials.json in the project directory to extract plaintext usernames and passwords. This encourages the use of predictable, insecure local storage for sensitive authentication data.
[DYNAMIC_EXECUTION]: The capture.py script performs unsafe string interpolation inside tab.evaluate() calls. It inserts Python variables such as username, password, and url directly into JavaScript strings executed in the browser context. This pattern is vulnerable to injection attacks if these inputs contain malicious payloads or escape characters (e.g., single quotes).
[EXTERNAL_DOWNLOADS]: The skill requires the installation of nodriver, a third-party Python library used for browser automation and anti-bot bypass, which is not part of a standard or pre-approved technology stack.
[COMMAND_EXECUTION]: The skill uses xvfb-run to execute Python scripts in a virtual framebuffer. While common for headless browser tasks, it executes local scripts with arguments derived from potentially untrusted project files (like the credentials JSON).

screenshot-compare