The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to install a CLI tool using npx -y @mvanhorn/printing-press-library and go install github.com/mvanhorn/printing-press-library. These downloads originate from the author's public repositories.
[DATA_EXFILTRATION]: The daraz-pp-cli tool includes a --deliver webhook:<url> parameter that can POST command output to an external server. Additionally, the feedback command can be configured to send local data to a remote endpoint via the DARAZ_FEEDBACK_ENDPOINT environment variable.
[COMMAND_EXECUTION]: The tool allows writing output directly to the file system using the --deliver file:<path> option, which could be used to overwrite sensitive files if the path is not strictly controlled.
[PROMPT_INJECTION]: The skill processes untrusted product data and reviews from Daraz.pk, creating a surface for indirect prompt injection.
Ingestion points: Product listings, descriptions, and reviews fetched from Daraz.pk via the products and reviews commands.
Boundary markers: None identified in the skill instructions to separate external data from agent instructions.
Capability inventory: The skill uses a tool capable of network requests (webhooks), file writing, and bash command execution.
Sanitization: No specific sanitization or validation of the external marketplace data is documented before it is passed to the agent context.

pp-daraz