The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill uses the browser-cookie3 library in scripts/mercadolivre.py to programmatically extract session cookies from various local web browsers, including Chrome, Firefox, Brave, Edge, and Opera. This provides the agent with access to the user's active login sessions.
[DATA_EXFILTRATION]: Extracted session cookies are stored locally in a file named .cookies_cache.json within the skill's directory. The skill also includes a command to export these cookies to an arbitrary file path specified by the user.
[EXTERNAL_DOWNLOADS]: The skill's requirements.txt specifies browser-cookie3, which is a dependency capable of accessing sensitive browser profile databases on the local file system.
[PROMPT_INJECTION]: The skill processes untrusted third-party data from Mercado Livre, creating a surface for indirect prompt injection.
Ingestion points: Product titles, descriptions, variations, and user reviews are scraped from mercadolivre.com.br in the scripts/mercadolivre.py file.
Boundary markers: The scraped content is not wrapped in protective delimiters or accompanied by instructions to ignore embedded commands.
Capability inventory: The skill uses Camoufox and Playwright for web automation and writes authentication data to the local file system.
Sanitization: There is no evidence of filtering or sanitizing the retrieved marketplace text to prevent potential instruction injection targeting the LLM.

mercadolivre