The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill utilizes evalJSON and evalJSONBase64 functions in scripts/cdp-utils.js to execute dynamically generated JavaScript strings within a browser environment. Scripts like dz-browse-scraper.js and heiyan-booklist-scraper.js construct these scripts at runtime to extract data from target web pages.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external platforms, creating a vulnerability surface where malicious instructions in story content could influence agent behavior.\n
Ingestion points: Web scrapers in scripts/dz-browse-scraper.js (scraping ishugui.com) and scripts/heiyan-booklist-scraper.js (scraping zhangwenpindu.cn) extract story titles, descriptions, and metadata.\n
Boundary markers: No explicit delimiters or safety instructions are used to separate external data from the agent's prompts.\n
Capability inventory: The skill possesses file-writing capabilities and can execute shell commands through the agent-browser utility.\n
Sanitization: Only basic whitespace normalization and string truncation are performed on the ingested content.\n- [CREDENTIALS_UNSAFE]: The scripts/heiyan-booklist-scraper.js script extracts the Admin-Token cookie from the browser's document context. This session credential is then used to authenticate requests to the platform's backend APIs.\n- [COMMAND_EXECUTION]: The utility script scripts/cdp-utils.js uses child_process.execFileSync to invoke the agent-browser CLI tool, which is used for browser-based data collection.\n- [OBFUSCATION]: The evalJSONBase64 function in scripts/cdp-utils.js encodes JavaScript code into Base64 before passing it to the browser control interface. While this is used for cross-platform compatibility, it masks the executable logic from simple analysis.

story-short-scan