The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on the execution of local Python scripts, scripts/gather_pm.py and scripts/populate_pm.py, to perform its core functions of data aggregation and HTML report generation.
[EXTERNAL_DOWNLOADS]: The skill performs network requests to multiple external domains, including Linear, Jira, Stripe, Sentry, and competitor RSS/Atom feeds, to retrieve product metrics.
[EXTERNAL_DOWNLOADS]: The script scripts/gather_pm.py explicitly disables SSL certificate verification and hostname checking in multiple functions (fetch_url, query_linear_api, query_jira_api, query_stripe_api, query_sentry_api) by setting ssl.CERT_NONE and check_hostname = False. This insecure network configuration allows for Man-in-the-Middle (MitM) attacks, which could lead to data tampering or information theft.
[CREDENTIALS_UNSAFE]: The skill uses environment variables to handle sensitive API keys for services like Stripe, Jira, and Linear. Because the script disables SSL verification during network transport, these credentials are at risk of exposure to network interceptors.
[DATA_EXFILTRATION]: The scripts/gather_pm.py script uses the standard xml.etree.ElementTree library to parse competitor RSS/Atom feeds. This library is vulnerable to XML External Entity (XXE) attacks, which could potentially be used to read local files if a polled feed contains malicious XML content.
[PROMPT_INJECTION]: The skill presents an attack surface for indirect prompt injection by ingesting untrusted data from external sources and displaying it in a dashboard used for product decisions.
Ingestion points: scripts/gather_pm.py fetches text content from external URLs and competitor feeds.
Boundary markers: The skill does not implement boundary markers or instructions to the agent to treat this external content as untrusted.
Capability inventory: The skill writes local files and generates HTML dashboards.
Sanitization: While the HTML compiler in scripts/populate_pm.py escapes script tags to prevent XSS, it does not validate the semantic content of the aggregated data.

product-manager