The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructions direct users to install the usgs-earthquakes-pp-cli and usgs-earthquakes-pp-mcp binaries from the author's repository using npx and go install (e.g., github.com/mvanhorn/printing-press-library).
[COMMAND_EXECUTION]: The watch command includes a --notify flag that allows the execution of arbitrary shell commands as hooks. The sql command enables running direct SQL queries against a local SQLite database.
[DATA_EXFILTRATION]: The --deliver flag supports a webhook:<url> sink, which allows the agent to send command outputs and earthquake data to external network endpoints via HTTP POST requests.
[PROMPT_INJECTION]: The skill ingests data from external USGS feeds, creating an attack surface for indirect prompt injection. While USGS is a trusted source, the skill's capabilities (shell hooks, SQL, webhooks) could be exploited if malicious data were introduced into the feed.
Ingestion points: USGS FDSN Event service and summary feeds.
Boundary markers: None specified in instructions.
Capability inventory: Shell command execution via --notify, SQL execution via sql command, and network exfiltration via --deliver webhook.
Sanitization: No explicit sanitization or validation of the external feed content is documented before it is used in the monitoring hooks or processed by the agent.

pp-usgs-earthquakes