The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the user or agent to download and install external binaries and packages from non-standard sources.
Evidence includes npx -y @mvanhorn/printing-press-library install restaurant365-odata --cli-only and go install github.com/mvanhorn/printing-press-library/library/commerce/restaurant365-odata/cmd/restaurant365-odata-pp-cli@latest.
[REMOTE_CODE_EXECUTION]: The installation methods (NPM/npx and Go install) involve downloading and executing code from remote repositories at runtime.
[COMMAND_EXECUTION]: The skill maps user-provided $ARGUMENTS directly into shell command invocations (e.g., restaurant365-odata-pp-cli <command> [subcommand] [args] --agent). While it uses the --agent flag for safety, arbitrary argument passing can lead to unexpected command execution behaviors.
[DATA_EXFILTRATION]: The skill documents and promotes a --deliver webhook:<url> feature. This allows the CLI to POST command outputs, which may contain sensitive business or employee data from Restaurant365, to an arbitrary external URL. Additionally, the feedback command allows sending local notes to an external endpoint if configured.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection attack surface.
Ingestion points: Untrusted data enters the agent context via the Restaurant365 OData reporting views (e.g., Employees, Transactions, SalesDetail).
Boundary markers: None identified in the prompt instructions to isolate API data from instructions.
Capability inventory: The skill possesses powerful capabilities including Bash execution (via the CLI), writing results to the local filesystem (--output), and sending data to arbitrary network endpoints (--deliver webhook:<url>).
Sanitization: The skill mentions redaction of values in sample and deleted-records by default, but provides explicit flags (--include-values) to bypass this, and the standard data retrieval commands do not appear to redact data by default.

pp-restaurant365-odata