The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes an external browser automation tool (agent-browser) using child_process.execFileSync. This is the core mechanism for its scraping functionality. The utility script cdp-utils.js specifically includes logic to resolve npm shims on Windows and bypass shell interpretation to avoid command injection vulnerabilities (referencing CVE-2024-27980).
[EXTERNAL_DOWNLOADS]: The skill performs network requests to multiple well-known web novel platforms, including qidian.com, fanqienovel.com, jjwxc.net, ciweimao.com, and qimao.com. These downloads are essential for fetching the rankings and book details required for analysis.
[DYNAMIC_EXECUTION]: The scrapers dynamically generate JavaScript snippets to be executed within the browser context via the automation tool. This is used for complex DOM extraction and handling anti-scraping measures, such as font-de-obfuscation on the Fanqie platform. The variables injected into these scripts are sanitized using JSON.stringify to prevent script injection.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted content from the public internet (novel titles, descriptions, and user tags). While this constitutes an attack surface, the scripts implement data cleaning, whitespace normalization, and character-count-based truncation (e.g., 100-character limit for descriptions) before the data is presented to the agent for analysis.

story-long-scan