The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The archived script scripts/archive/gt-v1/gt.py manages a local Python virtual environment and performs package installation using pip install -q pytrends tabulate.
[COMMAND_EXECUTION]: The skill makes extensive use of shell command orchestration via execSync, spawn, and subprocess.run to coordinate Node.js scripts, Python utilities, and external CLI tools such as wrangler, opencli, and gh.
[DYNAMIC_EXECUTION]: Multiple data collection utilities (e.g., scripts/gt-browser.mjs, scripts/ga4-setup.mjs, scripts/is-agentic.mjs) use the opencli bridge to inject and execute arbitrary JavaScript (eval) into the user's browser context for automation and metadata extraction.
[DYNAMIC_EXECUTION]: The script scripts/archive/gt-v1/gt.py uses os.execve() to perform process replacement during its virtual environment bootstrap process.
[EXTERNAL_DOWNLOADS]: The skill fetches data from numerous third-party domains, including official service endpoints (google.com, apple.com, cloudflare.com, anyway.sh, kie.ai) and various public platforms and communities (github.com, reddit.com, news.ycombinator.com, poki.com, itch.io).
[INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect prompt injection due to its core function of ingesting and processing untrusted content from competitor websites, social media threads, and search results. While scripts like scripts/demand/ai-probe.mjs implement basic text cleaning, the risk of an LLM adopting malicious instructions embedded in these external data sources is present.

rankup