The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill requires downloading software from third-party repositories. It directs users to install a CLI tool via npx -y @mvanhorn/printing-press-library and Go binaries from github.com/mvanhorn/printing-press-library.
[REMOTE_CODE_EXECUTION]: The skill facilitates the installation and execution of remote code through package managers (npx, go install). While these resources belong to the skill author, they represent an external dependency chain that executes code on the host system.
[DATA_EXFILTRATION]: The skill exposes a significant exfiltration vector through the --deliver webhook:<url> command-line flag. This feature allows the agent to POST command results directly to a remote server. When combined with commands that access sensitive data—such as generations list (image history), storage (account metadata), and profiles (user data)—this capability could be abused to leak private account information if the URL parameter is manipulated.
[CREDENTIALS_UNSAFE]: The skill requires the user to extract and provide a MIDJOURNEY_COOKIE_HEADER. The instructions suggest persisting this sensitive authentication token in local configuration files, which poses a risk of credential theft if the environment is accessed by other malicious scripts or if the agent is compromised.
[COMMAND_EXECUTION]: The skill extensively uses shell commands to drive the midjourney-pp-cli binary. It includes a natural-language capability matching command (which) that processes user-supplied strings directly, creating a surface for potential command injection if the underlying CLI tool does not strictly sanitize the input.

pp-midjourney