The Agent Skills Directory

[DATA_EXFILTRATION]: The tool supports a --deliver webhook:<url> argument that can POST command results to an arbitrary external URL. While a legitimate feature of the CLI, it provides a potential exfiltration vector if the agent is manipulated into sending sensitive data to an attacker-controlled endpoint.
[DATA_EXFILTRATION]: The feedback command can be configured to transmit local information to a remote server when the PEXELS_FEEDBACK_ENDPOINT environment variable is set.
[EXTERNAL_DOWNLOADS]: The skill provides instructions to download and install its core components from the vendor's official GitHub and NPM repositories (github.com/mvanhorn/printing-press-library and @mvanhorn/printing-press-library). These are vendor-owned resources and are standard for this tool's installation.
[COMMAND_EXECUTION]: The skill relies on executing the pexels-pp-cli binary and provides setup commands using npx and go install to prepare the environment.
[PROMPT_INJECTION]: The skill processes media metadata and collection details from the Pexels API, representing an indirect prompt injection surface.
Ingestion points: Data enters the agent context via the outputs of photos, videos, and collections commands.
Boundary markers: Commands utilize the --agent flag to enforce structured JSON output, which provides some separation between data and instructions.
Capability inventory: The skill can execute local binaries and perform network POST operations through the webhook delivery and feedback features.
Sanitization: There is no explicit sanitization or filtering mentioned for the external content retrieved from the Pexels API.

pp-pexels