The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill requires the installation of a CLI tool and an MCP server from external repositories managed by the author. Evidence includes instructions to use npx -y @mvanhorn/printing-press-library and go install github.com/mvanhorn/printing-press-library/... for setup.
[DATA_EXFILTRATION]: The CLI tool supports a --deliver webhook:<url> flag, which enables the agent to send command results (retrieved PyPI metadata) to arbitrary external URLs. While this is a documented feature for data routing, it represents a network capability that should be used with caution.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the PyPI JSON API and RSS feeds (e.g., package descriptions and metadata). There is a risk that maliciously crafted package metadata could attempt to influence the agent's behavior during processing.
Ingestion points: Package metadata lookups and RSS feed commands (pypi-pp-cli rss).
Boundary markers: None specified in the prompt instructions to separate PyPI content from agent instructions.
Capability inventory: The skill uses the Bash tool to execute CLI commands and Read to inspect files.
Sanitization: No specific sanitization or filtering of the remote PyPI data is described in the skill instructions.

pp-pypi