The Agent Skills Directory

[DATA_EXFILTRATION]: The delta-trip-pp-cli tool supports a --deliver webhook:<url> flag. This feature allows the output of any command—which may include sensitive travel data such as confirmation numbers, passenger names, and full itineraries—to be POSTed to an arbitrary external URL.
[DATA_EXPOSURE]: The CLI provides a --deliver file:<path> option. This allows the agent to write trip data and flight details directly to the local filesystem, potentially exposing information to other local processes or users.
[EXTERNAL_DOWNLOADS]: The skill requires the installation of a binary via npx from the @mvanhorn/printing-press-library package or through go install from the github.com/mvanhorn/printing-press-library repository. These resources are managed by the skill's vendor and are used to provide the primary functionality.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external travel providers. It possesses the capability to write to the filesystem and perform network operations via the delivery sinks. Although it defaults to structured JSON output in agent mode, the combination of external data ingestion and write/network capabilities presents a surface for potential misuse.

pp-delta-trip