The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructions direct the agent to install the lunch-money-pp-cli tool using npx -y @mvanhorn/printing-press-library or go install github.com/mvanhorn/printing-press-library/.... These resources originate from the identified vendor 'mvanhorn'.
[REMOTE_CODE_EXECUTION]: The installation process involves downloading and executing Node.js packages via npx or compiling Go source code, which constitutes remote code execution during the setup phase.
[DATA_EXFILTRATION]: The CLI tool features an --deliver webhook:<url> flag that allows the output of any command—which typically includes sensitive financial transactions, account balances, and net worth data—to be POSTed to an arbitrary external URL. While presented as a feature for data routing, it provides a functional vector for sensitive data exfiltration.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data in the form of financial transaction payees and notes which could contain malicious instructions designed to influence the agent's behavior when it processes the command output.
Ingestion points: Financial transaction data fetched from the Lunch Money API (processed in commands like triage, transactions retag, and transactions get-all).
Boundary markers: Absent. The skill does not specify delimiters or instructions for the agent to ignore embedded content within transaction fields.
Capability inventory: The skill has access to the Read Bash tool, allowing it to execute CLI commands that perform network operations (webhook:<url>), file writes (file:<path>), and database operations (SQLite sync).
Sanitization: Absent. There is no mention of sanitizing transaction notes or payees before they are returned to the agent context.

pp-lunch-money