The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructions direct the agent to install external software using npx -y @mvanhorn/printing-press-library and go install github.com/mvanhorn/printing-press-library/.... This involves fetching code from external repositories for local execution.
[REMOTE_CODE_EXECUTION]: The use of npx -y downloads and executes a package immediately, which is a common vector for remote code execution if the package or its dependencies are compromised.
[DATA_EXFILTRATION]: The CLI tool features a --deliver webhook:<url> flag, allowing command output to be sent to any remote URL. Additionally, the tool includes a feedback system that can be configured to transmit local data to a remote server via the AIRHINT_FEEDBACK_ENDPOINT environment variable, which could be misused for exfiltration.
[COMMAND_EXECUTION]: The skill executes shell commands through the airhint-pp-cli binary and provides a which command that accepts natural-language strings as arguments. This increases the attack surface for command injection if inputs are not properly sanitized before being passed to the shell.

pp-airhint