The Agent Skills Directory

[DATA_EXFILTRATION]: The skill implements a --deliver webhook:<url> feature that allows the output of any CLI command to be POSTed to an external URL. This enables the transmission of song data, lyrics, and user library metadata to arbitrary remote servers.
[DATA_EXFILTRATION]: The auth login --chrome command is designed to extract session cookies and authentication tokens from the user's browser, which are then used by the CLI for authentication with Suno.
[COMMAND_EXECUTION]: The sql command allows users to run arbitrary SQL queries against a local SQLite database storing Suno track information. Although documented as read-only, it provides a direct interface for querying structured local data via an agent-invokable CLI.
[EXTERNAL_DOWNLOADS]: The skill requires the installation of external binaries via npx (from @mvanhorn/printing-press-library) and go install (from github.com/mvanhorn/printing-press-library). These resources are hosted on public registries and are owned by the skill's author.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external content (track titles, lyrics, metadata) fetched from the Suno API.
Ingestion points: Song data and lyrics are ingested through commands like clips list, clips get, and generate lyrics-status (found in SKILL.md).
Boundary markers: The instructions do not define delimiters or specific "ignore instructions" wrappers for data returned from the API.
Capability inventory: The skill has the capability to execute shell commands (suno-pp-cli), write to local files (--deliver file:), and perform network operations (webhook sink and API calls).
Sanitization: There is no evidence of sanitization or filtering of API-returned content before it is processed by the agent.

pp-suno