The Agent Skills Directory

[SAFE]: The skill is a technical guide for building browser userscripts. It provides legitimate instructions for using standard features in Tampermonkey and ScriptCat managers.
[DATA_EXFILTRATION]: The documentation includes guidance on using GM_xmlhttpRequest and GM_cookie for cross-origin interactions. It correctly instructs the developer to use explicit @connect metadata to manage these permissions, which is the standard security model for userscript managers.
[REMOTE_CODE_EXECUTION]: The skill mentions standard userscript metadata such as @require, @scriptUrl, and update URLs, which are used by managers to load and update external code. It provides templates for using these features in a development context.
[PERSISTENCE]: The skill details ScriptCat's @background and @crontab headers, which allow scripts to execute persistently or on a schedule within the browser extension's sandbox environment.
[INDIRECT_PROMPT_INJECTION]: The skill functions as a code generation assistant for userscripts.
Ingestion points: User-supplied functional requirements (SKILL.md).
Boundary markers: None explicitly specified for the input data.
Capability inventory: Generated code can perform cross-origin network requests, access cookies, and modify DOM content.
Sanitization: The instructions emphasize security best practices, such as adopting the 'smallest permission surface' and requiring explicit @connect declarations to limit the generated script's capabilities.

develop-userscripts