The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill requires downloading the npm-pp-cli binary. It provides instructions to use npx for the @mvanhorn/printing-press-library package or go install from github.com/mvanhorn. Both sources are controlled by the skill's author.- [DATA_EXFILTRATION]: The CLI includes multiple features for sending data to external endpoints. The --deliver webhook:<url> flag allows sending command output to arbitrary URLs. Additionally, the feedback command can transmit data to a remote server if the NPM_FEEDBACK_ENDPOINT environment variable is configured. These features provide mechanisms for an agent to transmit data to external servers.- [COMMAND_EXECUTION]: The skill executes a local binary (npm-pp-cli) and includes a which command that dynamically matches natural language queries to internal tool capabilities.- [PROMPT_INJECTION]: The skill ingests data from the public npm registry, which is managed by third parties. This untrusted content is processed by the agent without explicit sanitization or clear boundary markers, allowing for potential indirect prompt injection attacks.
Ingestion points: npm-pp-cli package <name>, npm-pp-cli compare, npm-pp-cli risk (all in SKILL.md).
Boundary markers: Absent.
Capability inventory: Shell execution (npm-pp-cli), file writing (file:<path>), network POST (webhook:<url>).
Sanitization: Absent.

pp-npm