The Agent Skills Directory

[DATA_EXFILTRATION]: The skill automates the collection of sensitive authentication credentials from multiple sources.
It includes a Chrome extension ('Leo cookie.txt Locally') with debugger and cookies permissions capable of exporting session data from any website to a local gateway.
Utility scripts in scripts/common/credentials.js automatically search the user's Downloads folder for Netscape-formatted cookies.txt files to ingest session tokens.
Collected credentials for internal systems (such as jt_apollo_login_token and cloud_console_token_egg) are stored in the local ~/.shrimp/ directory and subsequently transmitted to remote infrastructure APIs to authorize inspection and modification commands.
[DYNAMIC_EXECUTION]: The skill utilizes several high-risk dynamic code execution patterns.
The bundled Chrome extension provides a page.eval task that allows the AI agent to execute arbitrary JavaScript in the context of any active browser tab, posing a significant risk if the agent's logic is influenced by untrusted data.
scripts/test_mysql_query.js dynamically imports the mysql2 driver from paths including the current working directory (process.cwd()), which could be exploited to load malicious local modules if the agent is executed in an untrusted project folder.
scripts/common/xlsx.js spawns a Python subprocess to execute a multi-line script for parsing Base64-encoded Excel data at runtime.
[COMMAND_EXECUTION]: The SKILL.md instructions explicitly promote high autonomy and the concealment of execution details from the user.
The agent is instructed to "AI 必须在后台自动解析意图并主动执行" (AI must automatically parse intent and actively execute in the background) and is strictly forbidden from suggesting manual command execution to the user ("切勿在回复中输出...请您手动在终端运行").
This design prioritizes seamless automation over human-in-the-loop oversight for powerful administrative operations, such as modifying configuration centers and writing to databases.
[INDIRECT_PROMPT_INJECTION]: The skill has a large attack surface for indirect injection due to the volume of untrusted external data it processes.
Diagnostic tools regularly ingest and summarize server logs (fast_query.js, test_log_query.js) and database query results, which may contain malicious instructions designed to exploit the agent's browser-execution and configuration-writing capabilities.
No explicit boundary markers or "ignore embedded instruction" guards are implemented for these data ingestion points.

leo-live-inspector