The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill requires downloading software from third-party sources not on the trusted list, specifically using npx to fetch @mvanhorn/printing-press-library and go install to fetch from github.com/mvanhorn/printing-press-library.
[REMOTE_CODE_EXECUTION]: The skill instructions direct the agent to install and execute binary tools (seats-aero-pp-cli and seats-aero-pp-mcp) from an external GitHub repository.
[DATA_EXFILTRATION]: The skill documents a --deliver webhook:<url> flag that allows command results to be sent to any external URL. Additionally, the feedback command and the SEATS_AERO_FEEDBACK_ENDPOINT environment variable provide a mechanism to automatically exfiltrate local session journals to remote servers.
[DYNAMIC_EXECUTION]: The CLI implements a 'Playbook' system that utilizes slot substitution (e.g., {slot}) to dynamically assemble and execute shell commands at runtime based on stored choreographies.
[INDIRECT_PROMPT_INJECTION]: The skill has a high surface area for indirect injection as it ingests untrusted data from the Seats.aero API and user queries to drive its 'Automatic learning' loop and playbook execution.
Ingestion points: External Seats.aero Partner API responses and user-supplied queries processed by the recall and teach commands.
Boundary markers: None identified in the skill instructions to separate external data from agent instructions.
Capability inventory: The skill uses the Read Bash tool and a local binary to perform network operations, file writes to a SQLite database, and execution of playbook steps.
Sanitization: The documentation mentions an automatic PII stripping mechanism in the teach command, though this is not verifiable through static analysis.
[COMMAND_EXECUTION]: The skill relies on the execution of various bash commands to interface with the seats-aero-pp-cli binary.

pp-seats-aero