The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads and installs the slickdeals-pp-cli tool and associated libraries from official vendor sources.
Evidence includes: npx -y @mvanhorn/printing-press-library install slickdeals --cli-only and go install github.com/mvanhorn/printing-press-library/library/commerce/slickdeals/cmd/slickdeals-pp-cli@latest.
These resources are owned by the skill's vendor (mvanhorn) and are standard for software distribution.
[REMOTE_CODE_EXECUTION]: The skill facilitates the installation and execution of external software via standard package managers (NPM and Go).
The go install and npx commands download and execute binaries from the vendor's infrastructure.
[COMMAND_EXECUTION]: The skill relies on the execution of the slickdeals-pp-cli binary to perform deal searches, analytics, and metadata management.
The agent is instructed to use the --agent flag for non-interactive execution, which is a best practice for automated skills.
[DATA_EXFILTRATION]: The CLI tool includes a built-in --deliver webhook:<url> feature that allows routing command results to an external HTTP endpoint.
While this is a functional capability of the tool for automation (e.g., syncing deal alerts to a user's service), it represents a potential data egress point that should be monitored.
[PROMPT_INJECTION]: The skill has an indirect prompt injection surface as it processes external, untrusted content from Slickdeals RSS feeds and JSON endpoints.
Ingestion points: Slickdeals RSS feeds and featured-coupons JSON endpoints (SKILL.md).
Boundary markers: None explicitly defined in the instructions to separate external data from agent instructions.
Capability inventory: The skill allows for deal searching, thumb-count tracking, and merchant analytics using a local SQLite database.
Sanitization: No explicit sanitization or validation of the deal content (titles, descriptions) is specified before the agent processes the data.

pp-slickdeals