The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: Downloads and installs the core CLI tool from vendor-managed repositories.
Evidence: The skill instructs the agent to run npx -y @mvanhorn/printing-press-library install shopper and go install github.com/mvanhorn/printing-press-library/... to obtain the necessary binaries.
[DATA_EXFILTRATION]: Contains a feature that enables the transmission of command output to external network destinations.
Evidence: The --deliver webhook:<url> flag allows command results, which may include sensitive personal addresses and recurring order details, to be POSTed to any user-provided URL.
[COMMAND_EXECUTION]: Relies on shell-based interaction to perform grocery management tasks and local database operations.
Evidence: Extensively uses the Bash tool to execute shopper-pp-cli for catalog searches, basket audits, and price tracking.
[PROMPT_INJECTION]: Vulnerable to indirect prompt injection from external grocery catalog data.
Ingestion points: Data entering the context from shopper-pp-cli via catalog, cart, and address commands in SKILL.md.
Boundary markers: Absent; there are no delimiters or warnings to ignore instructions embedded in the API responses.
Capability inventory: The skill has access to Bash (command execution) and Read tools across all operations.
Sanitization: Absent; product names, descriptions, and other catalog metadata are not sanitized before processing.

pp-shopper