The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads the forkable-pp-cli and forkable-pp-mcp tools from the vendor's official GitHub repository and NPM registry during the installation process.
[COMMAND_EXECUTION]: Executes the forkable-pp-cli binary to interact with the Forkable platform, performing actions like account queries, order management, and history retrieval.
[DATA_EXFILTRATION]: Provides a --deliver webhook:<url> sink that allows the agent to POST command results, which contain potentially sensitive personal meal and spending history, to arbitrary external URLs.
[DYNAMIC_EXECUTION]: Implements a local "playbook" system that auto-synthesizes and executes sequences of CLI commands based on a journal of previous user interactions and query mappings.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: Data is fetched from Forkable's internal GraphQL API, including menu items, delivery details, and account preferences (SKILL.md).
Boundary markers: The instructions do not specify any delimiters or safety markers for the data returned from the external API before it is processed.
Capability inventory: The skill can execute local binaries, write to the filesystem via the file: sink, and perform network requests via the webhook sink.
Sanitization: No explicit sanitization or validation of the content retrieved from the Forkable API is described.

pp-forkable