The Agent Skills Directory

Handling of Untrusted Content: The skill incorporates a security-conscious approach to processing data from external sources like emails, chat transcripts, and documents. It explicitly instructs the agent to treat these as 'untrusted content' and to interpret them as data only, never as instructions. This is a key defense against indirect prompt injection.
Human-in-the-Loop for Actions: For any action where the target, recipient, or content is determined by untrusted external text, the skill requires the agent to present the proposed action to the user for confirmation before execution. This prevents potential exploitation via external data.
Secure Linking Practices: The skill prevents the rendering of links found within untrusted content, instead directing the user to the verified record or thread ID within the primary tool. It also explicitly forbids 'guessing' URLs, ensuring that all navigated links are derived from authoritative sources.
Restricted Scheduled Execution: During scheduled or unattended runs, the skill prohibits untrusted content from initiating new actions, converting them into proposals for human review instead. This limits the potential for autonomous actions triggered by external inputs.
Indirect Prompt Injection Surface: As the skill processes data from emails and chats, it possesses an inherent attack surface for indirect prompt injection. However, the skill includes several mitigations for this:
Ingestion points: Data enters the context via CRM records, emails, chat messages, and uploaded files (SKILL.md).
Boundary markers: The instructions explicitly define external sources as untrusted and state they should be treated as data, not instructions.
Capability inventory: The skill can perform CRM writes and updates via specific tools like update-opportunity (SKILL.md).
Sanitization: It mandates reporting instruction-like text instead of acting on it and prohibits rendering external links.

renewal-radar