The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to download and install the scrape-do-pp-cli binary using npx -y @mvanhorn/printing-press-library or go install github.com/mvanhorn/printing-press-library/.... These resources originate from the vendor's own package registry and repository.
[COMMAND_EXECUTION]: The skill utilizes the Read Bash tool to execute a local CLI. It includes a --deliver file:<path> feature that allows writing command output to arbitrary file system paths, which could be misused to overwrite sensitive configuration files or create persistent scripts if not carefully restricted.
[DATA_EXFILTRATION]: The CLI provides a --deliver webhook:<url> flag, enabling the transmission of scraped data or command results to external HTTP endpoints. Additionally, the feedback --send command is designed to transmit locally stored feedback to a remote endpoint if configured.
[INDIRECT_PROMPT_INJECTION]: The skill provides a surface for injection through the sql command, which executes raw SQL strings against a local SQLite database, and the google search command, which processes natural language queries. The instructions lack explicit mention of input sanitization or boundary markers to prevent the agent from being manipulated by malicious search results or untrusted data sources.

pp-scrape-do