The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to install the 1688-pp-cli binary using go install from github.com/mvanhorn/printing-press-library or via npx using @mvanhorn/printing-press-library. These are vendor-owned resources and are necessary for the skill's operation.
[COMMAND_EXECUTION]: The skill relies on executing the 1688-pp-cli tool via Bash to perform search, comparison, and reporting tasks. This requires the Read Bash tool permission.
[DATA_EXFILTRATION]: The CLI tool supports a --deliver webhook:<url> flag, which allows the agent to POST command results to an arbitrary external URL. This is a functional feature for data routing but represents a potential exfiltration vector if not monitored.
[PROMPT_INJECTION]: The skill ingests data from external sources (1688.com wholesale catalog). There is an indirect prompt injection surface as the agent processes this third-party marketplace data without specific instructions for sanitization or boundary markers.
Ingestion points: The offers and search commands in SKILL.md ingest data from 1688.com.
Boundary markers: None identified in the skill instructions.
Capability inventory: The skill uses the Bash tool to execute system commands.
Sanitization: No explicit sanitization or filtering of the marketplace data is described.

pp-1688