The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the morgen-pp-cli and morgen-pp-mcp tools from the developer's GitHub repository and NPM package registry.
[COMMAND_EXECUTION]: The skill is centered around executing shell commands via a binary to interact with the Morgen API.
[DATA_EXFILTRATION]: The tool includes a --deliver feature that can send the results of any command to a remote URL via webhook:<url>. This provides a direct mechanism for exfiltrating sensitive calendar events, tasks, and account integration details.
[COMMAND_EXECUTION]: The --deliver feature also allows writing command output to an arbitrary local file path via file:<path>, which could be used to overwrite or create files in sensitive directories.
[PROMPT_INJECTION]: The skill processes untrusted data from external calendar and task providers.
Ingestion points: Calendar events and tasks fetched via events list and tasks list in SKILL.md.
Boundary markers: None provided to distinguish between tool instructions and data content.
Capability inventory: The skill can execute shell commands, write to the filesystem, and perform network requests via the morgen-pp-cli tool.
Sanitization: No sanitization or validation of the fetched data is described, making the agent vulnerable to instructions embedded in event titles or task descriptions.

pp-morgen