The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/gefei-ask.mjs reads a local JavaScript file (gefei-chat.browser.js) and evaluates its source code directly within the browser's execution context using opencli.
[REMOTE_CODE_EXECUTION]: scripts/check-version.mjs performs self-updates by executing npm exec with an external package skills@1.5.21 that is downloaded at runtime.
[DYNAMIC_EXECUTION]: The archived Python script scripts/archive/gt-v1/gt.py uses os.execve to replace the current process with a Python executable from a dynamically created virtual environment.
[EXTERNAL_DOWNLOADS]: The script scripts/archive/gt-v1/gt.py automatically initializes a Python virtual environment and installs external dependencies (pytrends, tabulate) using pip during execution.
[COMMAND_EXECUTION]: Numerous scripts throughout the skill (e.g., scripts/ahrefs-setup.mjs, scripts/clarity-setup.mjs, scripts/naver-setup.mjs) execute shell commands to drive browser automation, perform network queries, and manipulate system settings. Notably, scripts/pagespeed.mjs uses osascript on macOS to forcefully activate the Chrome application window.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function involves ingesting and processing data from a wide variety of untrusted external sources, including Reddit (reddit-wishes.mjs), Hacker News (hn-signals.mjs), Chrome Web Store (chrome-ext-gap.mjs), and various app stores. This content is interpolated into the agent context, providing a large surface area for indirect prompt injection attacks.
[COMMAND_EXECUTION]: scripts/is-agentic.mjs executes external code via npx is-agentic to perform site scanning.

rankup