The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to download and install its core binaries from the vendor's official GitHub repository and NPM package registry using go install and npx commands.
[COMMAND_EXECUTION]: The skill operates by executing the clarity-pp-cli binary with various subcommands and flags to audit instrumentation and fetch telemetry.
[DATA_EXFILTRATION]: The CLI provides a --deliver webhook:<url> feature that allows the output of any command (such as local instrumentation audits or API insights) to be POSTed to an arbitrary external URL.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection when processing untrusted local content.
Ingestion points: The audit html command reads and parses the content of local HTML files (SKILL.md).
Boundary markers: None; there are no instructions or delimiters provided to ensure the agent ignores malicious instructions embedded within the audited HTML.
Capability inventory: The skill can execute the clarity-pp-cli tool, read files, and perform network requests via the webhook delivery sink.
Sanitization: No evidence of sanitization or validation of the HTML content is present before it is analyzed by the agent.

pp-clarity