The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of shell commands to manage a background browser automation process. This includes using setsid and & to detach the process from the current session and redirecting output to log files for monitoring.
[CREDENTIALS_UNSAFE]: The skill manages Douyin authentication cookies stored in a specific local profile directory (~/.easel-browser-profiles/DouyinProfile). These cookies are long-lived authentication tokens and their management within the skill's flow constitutes sensitive credential handling.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied data and interpolates it directly into command-line arguments for the publishing script.
Ingestion points: The --title, --content, and --tags arguments in the publish-video and publish commands take raw user-provided strings.
Boundary markers: The command templates do not use delimiters or explicit instruction warnings to separate user data from the command structure.
Capability inventory: The douyin_publish.py script utilizes Playwright for full browser automation, granting it the ability to perform network requests, interact with web pages, and access the file system.
Sanitization: There is no evidence of sanitization, escaping, or validation of user-provided content before it is passed to the shell script.
[PERSISTENCE]: The skill utilizes the setsid command in conjunction with shell backgrounding (&) to ensure that the publishing script persists and continues to run even after the AI agent's active execution session has terminated. This mechanism is specifically used to wait for and process out-of-band data like SMS verification codes.

skill-douyin-upload