The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the Withings Printing Press CLI and MCP server directly from the author's verified GitHub and NPM repositories using standard tools like go install and npx. These resources originate from the vendor's official infrastructure (@mvanhorn/printing-press-library and github.com/mvanhorn/printing-press-library).
[COMMAND_EXECUTION]: The skill's primary functionality is driving a local binary (withings-pp-cli) to perform health data synchronization, SQL querying, and report generation. It uses the Read Bash tool (or equivalent shell tool) to execute these commands.
[DATA_EXFILTRATION]: The CLI includes a --deliver webhook:<url> feature designed to POST command results to external endpoints. While this is a documented feature for automation, it creates a potential path for sensitive health data (including ECG signal IDs, blood pressure, and sleep debt metrics) to be sent to arbitrary external domains.
[INDIRECT_PROMPT_INJECTION]: The skill acts as a bridge between an agent and external data sources that may contain unverified content, creating an injection surface.
Ingestion points: Reads health data and annotations from the Withings API and accepts user-provided notes through the --note flag in SKILL.md.
Boundary markers: There are no explicit instructions or delimiters defined to separate untrusted health data or annotations from agent instructions in the output.
Capability inventory: The skill possesses binary execution capabilities, local file writing via --deliver file:<path>, and network POSTing via the webhook sink.
Sanitization: There is no evidence of sanitization or filtering of the health data or annotations before they are processed by the agent or delivered to external sinks.

pp-withings