The Agent Skills Directory

[DATA_EXFILTRATION]: The skill provides scripts to extract the intlAuthToken cookie from the user's browser using Playwright or Chrome DevTools Protocol. This sensitive credential is saved to ~/.vipkid-ops/config.json and used to authenticate API requests to the production backend.
[COMMAND_EXECUTION]: The scripts/ops_helper.py tool uses the subprocess module to run internal scripts (get_token_via_playwright.py and get_token_via_cdp.js) for authentication purposes.
[EXTERNAL_DOWNLOADS]: The skill's instructions guide the user to download and install external dependencies, including the playwright browser automation framework and the openpyxl library for Excel file manipulation.
[PROMPT_INJECTION]: The skill processes data from external files, which serves as an ingestion point for indirect prompt injection. This data is used to build API calls that can create or modify product packages on the backend.
Ingestion points: Data is ingested from Excel and JSON files in scripts/ops_helper.py through the parse_excel and batch_create functions.
Boundary markers: The skill incorporates a manual confirmation prompt (y/N) in the batch_create function to prevent accidental or unauthorized bulk operations.
Capability inventory: The skill has the capability to perform authenticated POST requests to a live production environment and execute local shell commands via scripts/ops_helper.py.
Sanitization: No explicit sanitization or content validation is performed on the data extracted from Excel or JSON files before it is processed by the skill and sent to the API.

vipkid-ops