The Agent Skills Directory

[UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The skill facilitates the installation of a binary tool using npx -y @mvanhorn/printing-press-library and go install from the author's GitHub repository. Although these originate from the skill author, they involve executing code from remote package registries.
[DATA_EXPOSURE_AND_EXFILTRATION]: The CLI tool is reported to automatically extract sensitive session cookies (cf_clearance and ph_session) from the local Chrome browser installation to verify authentication. Additionally, it offers a --deliver webhook:<url> parameter that can be used by an agent to transmit command results—potentially containing private data such as flight itineraries or point balances—to any specified internet address.
[INDIRECT_PROMPT_INJECTION]: The skill retrieves and processes untrusted flight data from external web APIs. While the tool possesses network and file system capabilities, it does not document specific sanitization logic or boundary markers to prevent malicious instructions hidden in search data from influencing the agent.
[COMMAND_EXECUTION]: The skill operates by invoking the pointhound-pp-cli binary through the Read Bash tool, allowing the agent to perform a wide range of system operations via a shell environment.

pp-pointhound