The Agent Skills Directory

[METADATA_POISONING]: The skill metadata identifies the author as 'jrimmer', which is inconsistent with the 'mvanhorn' vendor identification provided in the repository paths, installation modules, and development context.\n- [EXTERNAL_DOWNLOADS]: The skill instructs the installation of the CLI tool through npx -y @mvanhorn/printing-press-library, which involves downloading and executing code from the npm registry from a non-trusted repository.\n- [REMOTE_CODE_EXECUTION]: The skill provides instructions to download and install binaries using go install github.com/mvanhorn/printing-press-library/..., allowing for the execution of remote code from an unverified source.\n- [DATA_EXFILTRATION]: The CLI tool features a --deliver webhook:<url> flag, which enables the redirection of command output to an arbitrary external URL. This poses a data exfiltration risk if the agent is manipulated into using a malicious sink. The feedback command also allows sending local data to a remote endpoint if specific environment variables are configured.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from Forgejo instances (e.g., issue titles, PR descriptions, and notifications), creating an attack surface where external content could influence the agent's behavior.\n
Ingestion points: issue dashboard, notification inbox, pr queue, and release changelog commands.\n
Boundary markers: None implemented in the command instructions.\n
Capability inventory: The skill has network access for API calls and webhook delivery, plus the ability to write to local profiles and logs.\n
Sanitization: No content validation or sanitization mechanisms are described for the data retrieved from external instances.

pp-forgejo