The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to install a binary using npx -y @mvanhorn/printing-press-library or go install github.com/mvanhorn/printing-press-library/.... These resources originate from the identified vendor and are used to provide the skill's core functionality.
[COMMAND_EXECUTION]: The skill operates by executing the art-goat-pp-cli binary. It provides a comprehensive set of commands for interacting with art collections, managing a personal journal, and performing federated searches across museum sources.
[DATA_EXFILTRATION]: The CLI tool documented in the skill features a --deliver flag that supports a webhook:<url> sink. This functionality allows the agent to POST command results to an external HTTP endpoint. While presented as a feature for output routing, it represents a potential vector for data exfiltration if the agent is manipulated into sending sensitive journal data to an untrusted URL.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from multiple external museum and astronomy APIs which constitutes a vulnerability surface.
Ingestion points: Data enters the agent context via API responses from AIC, MET, NASA APOD, and other museum sources during commands like today or sit.
Boundary markers: The skill does not define explicit delimiters or instructions for the agent to ignore embedded commands within the art descriptions or metadata.
Capability inventory: The art-goat-pp-cli tool can write to files and send network requests to webhooks via the --deliver argument.
Sanitization: No explicit sanitization or filtering of external API content is mentioned in the skill instructions.

pp-art-goat