The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to download and install binaries using npx from the @mvanhorn npm scope and go install from the mvanhorn GitHub organization repositories.
[REMOTE_CODE_EXECUTION]: The installation process involves fetching and executing remote code via npx and go install to set up the substack-pp-cli and substack-pp-mcp tools.
[DATA_EXFILTRATION]: The CLI tool includes a built-in --deliver webhook:<url> feature that enables the transmission of potentially sensitive publication data, analytics, and subscriber information to arbitrary external URLs.
[CREDENTIALS_UNSAFE]: The tool accesses sensitive authentication data by reading Substack session cookies directly from the user's Chrome browser storage via the auth login --chrome command.
[INDIRECT_PROMPT_INJECTION]: The skill provides an attack surface for indirect prompt injection as it ingests untrusted external content from Substack (posts, notes, and comments) through various synchronization and search commands.
Ingestion points: Data is pulled into the agent's context via grep, portfolio sync, inbox home, and posts list-published (SKILL.md).
Boundary markers: The skill does not specify the use of delimiters or explicit instructions for the agent to ignore embedded commands within the retrieved content.
Capability inventory: The agent retains the ability to execute shell commands (via the bash tool) and perform local file system operations.
Sanitization: There is no mention of sanitization, escaping, or validation of the content retrieved from Substack before it is processed by the agent.

pp-substack