The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The scripts/heiyan-booklist-scraper.js file contains logic to programmatically extract the Admin-Token from the browser's document.cookie for the manage.zhangwenpindu.cn domain. This token is a sensitive session credential that grants access to administrative features.
[COMMAND_EXECUTION]: The scripts/cdp-utils.js script uses child_process.execFileSync to invoke the agent-browser CLI. It also includes a resolveWindowsAgentBrowser function that reads and parses .cmd files from the system PATH to resolve executable paths, which is an unusual and potentially risky file-access pattern.
[DATA_EXFILTRATION]: The skill is designed to scrape structured data from third-party platforms. In the case of the Heiyan platform, it uses the harvested Admin-Token to call internal backend APIs (e.g., ms.zhangwenpindu.cn/manage/book/list) to download book data, pricing, and internal metadata to local files.
[PROMPT_INJECTION]: The skill processes untrusted content (story titles and descriptions) scraped from the web or provided by the user. This creates an indirect prompt injection surface where malicious instructions embedded in web metadata could influence the agent's behavior.
Ingestion points: Scraped data from Pointing (ishugui.com) and Black Rock (heiyan) platforms, as well as user-provided snippets in Phase 2.
Boundary markers: Absent. The instructions do not use delimiters or warnings to ignore instructions within the processed data.
Capability inventory: The skill can execute subprocesses via execFileSync and write to the local file system using fs.writeFileSync.
Sanitization: Minimal. Descriptions are truncated to 150-200 characters, but no other sanitization or escaping is performed on the ingested content.

story-short-scan