The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill utilizes a browser control proxy to execute JavaScript in the user's authenticated Chrome session. This is employed to identify full-text download candidates on publisher websites and to transfer file data in chunks from the browser to the local disk (e.g., in scripts/lib/cdp-utils.mjs, scripts/lib/pdf-utils.mjs, and scripts/lib/anti-bot.mjs).
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from academic search results and metadata providers (e.g., Crossref, Unpaywall). While it implements sanitization for filenames and search queries, this represents an attack surface for indirect prompt injection if external services were compromised to return malicious instructions. Capabilities include file writing and executing Python scripts for PDF verification (e.g., in scripts/lib/wos-supporting-information.mjs and scripts/lib/metadata.mjs).
[SAFE]: The skill follows security best practices for credential management. API keys for publishers are stored in a configuration file (~/.config/lit-dl/credentials.json) with 0600 permissions, and the system automatically redacts sensitive query parameters and Bearer tokens when generating manifests or logs.

nature-downloader