The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill uses npx to download and execute code from the npm registry during the installation phase (npx -y @mvanhorn/printing-press-library install passage --cli-only).
[EXTERNAL_DOWNLOADS]: The skill instructs the agent to install the passage-pp-cli using npx, which involves downloading a package from the public npm registry. This represents an external code dependency that is executed locally.
[DATA_EXFILTRATION]: The CLI includes a --deliver webhook:<url> flag that allows the agent to POST command results to a remote URL. This provides a built-in mechanism for sending data out of the local environment.
[COMMAND_EXECUTION]: The CLI supports a --deliver file:<path> flag, enabling the agent to write output to arbitrary file paths on the local system. This could potentially be used to write to sensitive locations if not properly constrained.
[PROMPT_INJECTION]: The skill's 'Automatic learning' loop (Step 2 decision tree) creates a surface for indirect prompt injection. The agent is instructed to read Playbook.notes 'verbatim' and replay Playbook.steps retrieved from a local database of 'learnings'.
Ingestion points: Untrusted data enters the agent context through the Playbook.notes, Playbook.steps, and Candidates fields returned by the recall command (SKILL.md).
Boundary markers: There are no explicit boundary markers or 'ignore embedded instructions' warnings for the retrieved playbook content.
Capability inventory: The skill allows shell execution of the passage-pp-cli and provides capabilities for writing to local files and sending data to webhooks via the --deliver flag.
Sanitization: No sanitization or validation of the retrieved 'learnings' is performed before the agent is instructed to follow the steps and notes 'verbatim'.

pp-passage