The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the ufo-goat-pp-cli tool via npx from the @mvanhorn registry and go install from the mvanhorn GitHub repository.
[COMMAND_EXECUTION]: The skill's core functionality relies on executing shell commands through the ufo-goat-pp-cli binary.
[DATA_EXFILTRATION]: The CLI tool supports a --deliver webhook:<url> feature that allows sending command output to arbitrary external URLs.
[PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection (Category 8) due to its ingestion of external manifests and file metadata. Ingestion points: Manifest synchronization (sync) and file metadata retrieval (list, search) where data enters the agent context. Boundary markers: The skill does not define specific delimiters or instructions to ignore instructions embedded in the UAP archive data. Capability inventory: The skill has access to shell execution, file downloads, and webhook POST requests. Sanitization: No sanitization or verification of the external data source content is documented.

pp-ufo