The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes untrusted data from web page snapshots to automate UI interactions.
Ingestion points: scripts/media_publisher.py (functions detect_popup_in_snapshot and check_login_status ingest raw text snapshots from Playwright).
Boundary markers: Absent; there are no delimiters or instructions to the agent to ignore commands found within the scraped web content.
Capability inventory: The skill utilizes Playwright MCP tools to navigate, click, and fill forms, and has scripts for reading and writing local cookie files.
Sanitization: Absent; the implementation relies on simple string matching against raw page content.
[COMMAND_EXECUTION]: The SKILL.md instructions recommend executing pkill -f chrome for resource cleanup. This command is overly broad and will terminate all Chrome processes on the system, potentially causing data loss in the user's unrelated browser sessions.
[DATA_EXFILTRATION]: The scripts/cookie_manager.py script facilitates the storage and export of sensitive session cookies in ~/.claude/media-auto-publisher/cookies.json. While intended for account management, storing authentication credentials in plain text locally increases the risk of credential exposure.

media-auto-publisher