The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the agent's computer operation capabilities to interact with a web browser. It specifically provides instructions for locating the search box, inputting text using 'setValue' or simulated keyboard events, and taking screenshots. The instructions include safety constraints, such as forbidding the agent from clicking links, submitting forms, or navigating to external websites during the collection cycle.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data in the form of autocomplete suggestions retrieved from the Douyin website. While this presents an attack surface where a third party could theoretically attempt to influence the agent's behavior via search suggestions, the skill mitigates this risk by using local Python scripts to validate, score, and export the data rather than having the LLM interpret the data as instructions. The scoring engine uses predefined regex patterns and includes a 50ms timeout to prevent performance-based attacks.
[EXTERNAL_DOWNLOADS]: The skill relies on standard, well-known Python libraries (openpyxl, Pillow, regex) for its data processing and reporting functions. These are declared in the requirements.txt and are standard in the ecosystem.
[SAFE]: The provided Python scripts (build_workbook.py, score_keywords.py) exhibit high security awareness. They include explicit checks for path traversal (validating that screenshot paths are within the package and contain no dangerous characters), Excel safety (quoting prefixes to prevent formula injection), and ReDoS protection (capping regex expansion and enforcing timeouts). The skill also requires user intervention for security-sensitive events like logins or CAPTCHAs.

yao-geo-douyin