The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill implements a local 'Cookie Vault' at references/cookie-vault.md. The workflow in SKILL.md explicitly directs the agent to save user-provided or session-acquired cookies to this file in plaintext. This practice exposes sensitive authentication tokens to anyone with access to the skill's environment.\n- [COMMAND_EXECUTION]: The skill utilizes a dynamic code generation pattern where it reads templates from the templates/ directory and fills them with user-provided parameters like URLs and CSS selectors. The resulting scripts are then executed via Bash(python*), which is a potential vector for code injection if inputs are not strictly validated.\n- [EXTERNAL_DOWNLOADS]: Installation and maintenance procedures involve downloading third-party Python packages via pip and browser dependencies via the scrapling install command. These actions fetch and install executable binaries and libraries from external repositories.\n- [DATA_EXFILTRATION]: The skill's architecture combines the ability to read sensitive local files (like the 'Cookie Vault') with the capability to perform outbound network requests via generated Python scripts. This combination presents a risk where session credentials could be exfiltrated to external domains during scraping operations.

scrapling