The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill provides instructions to download and install the movie-goat-pp-cli and movie-goat-pp-mcp tools using npx from the @mvanhorn npm package and go install from the mvanhorn/printing-press-library GitHub repository. These resources belong to the skill's vendor infrastructure.
[DATA_EXFILTRATION]: The tool includes a --deliver webhook:<url> flag, which allows the agent to transmit command results (such as movie ratings or watchlist data) to an arbitrary external URL via an HTTP POST request. While this is a documented feature for output delivery, it represents a network capability to non-whitelisted domains.
[INDIRECT_PROMPT_INJECTION]: The skill processes data retrieved from external sources, specifically the TMDb and OMDb APIs, and interpolates this content into agent-visible command results.
Ingestion points: Data returned by the movies, people, trending, and discover commands, as well as multi-source ratings from OMDb.
Boundary markers: The instructions do not define specific delimiters or warnings for the agent to ignore potentially adversarial content embedded in movie titles, descriptions, or metadata.
Capability inventory: The skill has the capability to execute shell commands (movie-goat-pp-cli), perform network operations (webhooks), and write to local files (--deliver file:<path>).
Sanitization: There is no explicit evidence of sanitization or filtering of external API content before it is processed by the agent.

pp-movie-goat