The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses npx to execute the @pachca/cli tool. This is the official command-line interface provided by the vendor (Pachca) to interact with their platform services.
[EXTERNAL_DOWNLOADS]: The skill instructs the agent to download the @pachca/cli package from the NPM registry. As this is a vendor-owned resource that matches the skill's author context, it is considered a legitimate and safe dependency for the skill's functionality.
[INDIRECT_PROMPT_INJECTION]: The skill processes data returned from the Pachca API regarding token status and scopes. This constitutes a data ingestion surface where external content is brought into the agent's context. However, the data is typically structured (JSON) and provided by the vendor's own API, presenting a minimal risk factor.

pachca-oauth