The Agent Skills Directory

[DATA_EXFILTRATION]: The skill implements a --deliver webhook:<url> feature that allows the output of any command to be sent to an arbitrary external URL. This provides a direct mechanism for exfiltrating sensitive lunch data, including spend trends, delivery addresses, and order history.
[COMMAND_EXECUTION]: The 'Automatic learning' loop (teach, recall, playbook) stores and executes command sequences from local storage. This mechanism allows for dynamic command execution based on state that could be manipulated by an attacker to achieve persistent code execution.
[CREDENTIALS_UNSAFE]: The authentication mechanism (auth login --chrome) is designed to extract session cookies directly from the user's browser, which are high-value authentication secrets.
[EXTERNAL_DOWNLOADS]: The skill requires the installation of external binaries from the author's NPM package (@mvanhorn/printing-press-library) and GitHub repository. While these are vendor-owned resources, they represent external code execution.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes data from the external Forkable web service. Evidence chain: 1. Ingestion points: Forkable GraphQL API responses processed by the CLI. 2. Boundary markers: No delimiters or instructions are present to prevent the agent from following commands embedded in the lunch data. 3. Capability inventory: The skill can execute shell commands via the CLI, write to arbitrary files via --deliver file, and perform network POSTs via --deliver webhook. 4. Sanitization: No sanitization of the external data is documented before it is processed by the agent.

pp-forkable