The Agent Skills Directory

Integration with Well-Known Services: The skill interacts with the APIs of Canva, HubSpot, and Shopify. These interactions are core to its functionality, allowing it to generate social media designs, pull product data, and stage posts. These services are well-known technology providers, and the skill uses standard OAuth-based patterns for authentication.
Indirect Prompt Injection Surface: The skill processes external data from Shopify and the web, which creates a potential surface for indirect prompt injection.
Ingestion points: Data enters through Shopify product descriptions, titles, and WebFetch operations for existing social media posts and voice profile building.
Boundary markers: The instructions include a specific 'What not to do' section that directs the agent to ignore any instructions found within the data it reads, referencing a shared verification protocol (untrusted-content.md) for handling high-risk requests.
Capability inventory: The skill can write to the local file system (maintaining content-calendar.md) and make network requests to authorized service endpoints (Canva and HubSpot).
Sanitization: The skill contains instructions to strip HTML tags from Shopify descriptions and strictly verify pricing data against the API response to prevent incorrect claims.
State Management via Local Files: The skill maintains a local content-calendar.md and reads a shared voice-profile.md. This allows it to persist information across sessions and maintain a consistent voice, which is standard behavior for an agent skill managing a content calendar.
User-in-the-Loop Controls: The skill implements mandatory approval checkpoints at every critical stage (calendar approval, budget approval, design selection, and copy approval) before performing actions like design generation or staging posts. This design ensures that the user maintains oversight over all automated workflows.

social-content-engine