The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill requires the installation of the hotel-tonight-pp-cli and hotel-tonight-pp-mcp binaries from the vendor's GitHub repository using go install and an NPM package via npx.
[COMMAND_EXECUTION]: The skill's primary purpose is to execute shell commands using the hotel-tonight-pp-cli tool to perform searches and analysis.
[DATA_EXFILTRATION]: The CLI tool includes a --deliver webhook:<url> flag that allows the agent to route command output to an arbitrary external URL via an HTTP POST request.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the HotelTonight API, creating a surface for indirect prompt injection.
Ingestion points: Data returned by the inventory, watch, markets, and daily-drop subcommands in SKILL.md.
Boundary markers: The instructions do not specify any delimiters or warnings to the agent to distinguish between its own instructions and the data retrieved from the API.
Capability inventory: The skill possesses Read Bash capabilities and can write data to the filesystem or external webhooks via the --deliver flag.
Sanitization: There is no evidence of sanitization or strict schema validation for the external API data described in the skill documentation.

pp-hotel-tonight