The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill requires the installation of the npm-pp-cli tool, which is fetched from the vendor's resources using npx from @mvanhorn/printing-press-library or go install from github.com/mvanhorn/printing-press-library.
[REMOTE_CODE_EXECUTION]: The setup process executes code downloaded from external sources through npx and the Go toolchain to install the required CLI binary.
[DATA_EXFILTRATION]: The CLI tool includes a built-in --deliver webhook:<url> flag, enabling the agent to transmit command results directly to any user-specified external URL.
[COMMAND_EXECUTION]: The skill uses the Bash tool to execute the npm-pp-cli binary with arguments and subcommands derived from user queries.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from the public npm registry, which serves as an untrusted ingestion point for potentially malicious instructions embedded in package metadata.
Ingestion points: Fetches package descriptions, maintainer info, and dependency data from the npm registry via npm-pp-cli (SKILL.md).
Boundary markers: Absent; the skill does not specify delimiters or instructions to ignore embedded directives in the registry data.
Capability inventory: Uses the Bash tool for command execution and supports writing to files or webhooks.
Sanitization: None described for the external content processed by the tool.

pp-npm