The Agent Skills Directory

[DATA_EXFILTRATION]: The CLI includes a --deliver webhook:<url> feature that allows the agent to POST command results to any external URL. This creates a risk of data exfiltration if the agent is directed to send sensitive information, such as credentials or private file contents, to an unauthorized endpoint.
[COMMAND_EXECUTION]: The skill implements an 'Automatic learning loop' that journalizes invocations and auto-synthesizes 'playbook candidates'. This allows the system to dynamically generate and propose command choreography based on past interactions, which could lead to unintended command execution if the learning store is poisoned.
[EXTERNAL_DOWNLOADS]: The skill requires the installation of a CLI binary via npx or go install. These instructions point to official vendor repositories (@mvanhorn/printing-press-library and github.com/mvanhorn/printing-press-library).
[PERSISTENCE_MECHANISMS]: The CLI maintains local state, including SQLite databases and logs, which allows behavior and data to persist across different agent sessions.
[INDIRECT_PROMPT_INJECTION]: The skill fetches files from remote GitHub repositories, creating an attack surface for indirect injection. \n 1. Ingestion points: Remote GitHub repository files and directory structures accessed via the CLI. \n 2. Boundary markers: The skill uses a structured JSON envelope for agent communication, but does not provide explicit instructions to ignore potentially malicious content within the fetched files. \n 3. Capability inventory: The skill has the capability to read/write files and make network requests. \n 4. Sanitization: No evidence was found of sanitization or filtering for content retrieved from remote repositories.

pp-github-contents