The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill transmits sleep-related data (bed/wake times, quality, exercise) to 'api.whenpeak.com' to generate performance predictions. This communication is the primary function of the skill and is protected by an explicit instruction for the agent to obtain user consent before the first API call in a conversation.
[COMMAND_EXECUTION]: The skill utilizes local Python scripts ('scripts/whenpeak_predict.py' and 'scripts/whenpeak_chart.py') to handle API requests and visualize performance curves. These scripts use the Python standard library for logic and an optional 'matplotlib' dependency for visualization, with no evidence of unsafe command construction or arbitrary code execution.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes data from an external API.
Ingestion points: Data enters the system through the JSON response fetched from 'https://api.whenpeak.com' in 'scripts/whenpeak_predict.py'.
Boundary markers: There are no explicit delimiters used for API data in the prompt construction, though the skill provides detailed instructions on how to parse the JSON and which fields to prioritize or ignore (e.g., ignoring marketing prompts).
Capability inventory: The skill has the capability to execute bundled Python scripts and perform network operations via those scripts.
Sanitization: The agent is instructed to perform structured data extraction from the JSON response and round float values for display, which reduces the risk of treating raw API strings as instructions.

whenpeak