The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill requires the installation of a CLI tool via npx -y @mvanhorn/printing-press and go install github.com/mvanhorn/printing-press-library/.... These resources are managed by the skill's author and are used to provide the core functionality.
[COMMAND_EXECUTION]: The skill operates by executing the espn-pp-cli binary with various arguments to fetch and display sports information.
[DATA_EXFILTRATION]: The CLI tool includes a --deliver flag that supports routing command output to external webhooks (webhook:https://...). It also features a feedback command that can POST data to a remote endpoint (ESPN_FEEDBACK_ENDPOINT). These are functional features of the tool but could be used to exfiltrate information if the agent is misdirected.
[PROMPT_INJECTION]: The skill has an indirect prompt injection surface because it ingests untrusted data from external sports news, search results, and game summaries. Malicious instructions embedded in this data could potentially influence the agent to misuse the CLI's data delivery or feedback capabilities, as there are no explicit boundary markers or sanitization steps defined in the instructions.

pp-espn