The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to download and install the immich-pp-cli binary and related tools using npx and go install from the vendor's (mvanhorn) repositories.
[DATA_EXFILTRATION]: The CLI tool supports a --deliver webhook:<url> flag which allows the agent to route command output—potentially containing sensitive photo library metadata, user session information, or asset IDs—to an arbitrary external URL.
[INDIRECT_PROMPT_INJECTION]: The skill implements a persistent 'learning loop' through recall, teach, and playbook amend commands. This system stores user queries and choreographed sequences (playbooks) in a local database, creating a surface where malicious data could influence future agent behavior.
Ingestion points: Data enters the context via user queries and command results processed by the recall and teach functions in SKILL.md.
Boundary markers: No explicit delimiters or 'ignore embedded instructions' warnings are enforced for data retrieved from the learning store.
Capability inventory: The skill has access to network operations (Immich API and webhooks), file system writes via the delivery sink, and sequence-based command execution via playbooks.
Sanitization: The documentation advises the agent to strip PII before teaching queries, but no automated sanitization is described.
[DYNAMIC_EXECUTION]: The playbook feature allows the agent to record and later execute a sequence of commands with variable substitution (slots). If a malicious playbook is injected into the local store, it could lead to unauthorized command execution.

pp-immich