The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from Splitwise account history, including expense descriptions and comments, through commands such as search, audit, get-expenses, and get-comments. This creates a surface where third parties (e.g., people sharing expenses with the user) could embed malicious instructions.
Ingestion points: search, audit, get-expenses, get-comments as described in SKILL.md.
Boundary markers: None identified in the prompt templates.
Capability inventory: The skill has access to the Bash tool and features flags for writing to local files (--deliver file:<path>) and sending data to remote endpoints (--deliver webhook:<url>).
Sanitization: There is no documented mechanism to sanitize or escape instructions found within external expense comments.
[EXTERNAL_DOWNLOADS]: The skill instructs the user/agent to install dependencies from external sources associated with the author (mvanhorn).
Evidence: Installation commands include npx -y @mvanhorn/printing-press-library and go install github.com/mvanhorn/printing-press-library/....
[DATA_EXFILTRATION]: The skill exposes a --deliver webhook:<url> feature that allows the agent to POST command results, which contain sensitive financial data, to a remote URL. While this is a documented integration feature, it represents a potential exfiltration vector if an agent is manipulated into sending data to an untrusted endpoint.

pp-splitwise