The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell commands via npx and the pachca CLI to perform audit tasks, check authentication status, and send notifications.
[EXTERNAL_DOWNLOADS]: The skill uses npx -y @pachca/cli to download and execute the vendor's official command-line interface from the NPM registry. As this package belongs to the skill's authoring organization, it is a standard functional dependency.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from Pachca security logs (e.g., pachca security list), which may contain user-generated content such as message updates or employee names. This external data is processed by the agent without explicit boundary markers or sanitization.
Ingestion points: Output from the pachca security list command, which includes event details and entity metadata.
Boundary markers: None specified in the instructions to separate data from instructions.
Capability inventory: The agent has access to shell execution (Bash) and network operations via the CLI tool, including the ability to create messages.
Sanitization: No evidence of input validation or content filtering is provided in the skill instructions.

pachca-security