The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the $ARGUMENTS variable to construct shell commands (e.g., boardgamegeek-pp-cli <command> [subcommand] [args] --agent). If these arguments are not properly sanitized by the underlying platform, they could be exploited for command injection.
[DATA_EXFILTRATION]: The --deliver webhook:<url> parameter allows the agent to POST the output of its operations to any arbitrary URL. While intended for data routing, this feature provides a mechanism for unauthorized exfiltration of data retrieved from the API or local context.
[COMMAND_EXECUTION]: The --deliver file:<path> functionality allows writing command output to arbitrary locations on the local filesystem, which could lead to unauthorized file creation or overwriting of sensitive files depending on the agent's permissions.
[EXTERNAL_DOWNLOADS]: The skill instructs the user or agent to install its core dependencies from the vendor's resources, specifically through the @mvanhorn/printing-press-library NPM package and the github.com/mvanhorn/printing-press-library Go module.

pp-boardgamegeek