The Agent Skills Directory

[DATA_EXFILTRATION]: The skill provides a --deliver webhook:<url> flag that allows the agent to POST command results to an arbitrary external URL. This creates a direct channel for exfiltrating processed data or local history to external servers.
[COMMAND_EXECUTION]: The CLI tool supports a --deliver file:<path> sink, enabling the agent to write the output of any command to a local file. This could be abused to overwrite critical configuration files or plant scripts if the agent is directed to do so by malicious input.
[DYNAMIC_EXECUTION]: The skill implements a 'playbook' mechanism that automatically synthesizes shell commands from the session journal and stores them in a local database. The agent is specifically instructed to 'replay Playbook.steps in order', which constitutes dynamic execution of commands retrieved from local state that can be modified over time.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process property listings from the external website Immoweb. Maliciously crafted listings could attempt to inject instructions to influence the agent's behavior, which is particularly risky given the skill's file-writing and network capabilities.
Ingestion points: External data is ingested via find, show, listings get, and pull commands in SKILL.md.
Boundary markers: The skill does not define specific delimiters or instructions for the agent to ignore content within the property listings.
Capability inventory: The agent has the ability to write to the file system (--deliver file:), perform network requests (--deliver webhook:, photos), and read bash output as defined in allowed-tools.
Sanitization: There is no evidence of sanitization or filtering of the content retrieved from Immoweb before it is presented to the agent.

pp-immoweb