The Agent Skills Directory

[Indirect Prompt Injection] (LOW): The skill ingests and displays product information (titles, shop names) from external e-commerce platforms via the maishou88.com API. While the skill itself has no high-privilege write or execute capabilities, malicious instructions embedded in product titles could potentially influence the behavior of the agent processing the output.
Evidence: scripts/main.py fetches data in search() and detail() and returns it to the agent as CSV or YAML.
[External Downloads] (LOW): The skill utilizes the uv package manager to download and install standard Python dependencies (aiohttp, PyYAML) at runtime.
Evidence: Inline script metadata in scripts/main.py defines dependencies.
[Command Execution] (LOW): The skill instructions require the agent to execute a local Python script using uv run. While parameters are passed via CLI arguments, the script itself is local and its behavior is transparent.
Evidence: Shell commands in SKILL.md invoke uv run scripts/main.py.
[Data Exposure] (INFO): The script contains a hardcoded INVITE_CODE ('6110440'). This is likely an affiliate or referral code used by the developer to track usage or earn commissions on the third-party platform.
Evidence: INVITE_CODE = os.getenv("MAISHOU_INVITE_CODE") or "6110440" in scripts/main.py.

maishou