The Agent Skills Directory

[SAFE]: The skill uses standard security practices, such as environment variables for API keys and application IDs. It interacts only with official vendor domains (apideck.com) and well-known services (zoho.com), which are consistent with its documented purpose.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external Zoho Books records (e.g., invoices, ledger accounts) into the agent's context via the apideck.accounting.invoices.list method in SKILL.md. No explicit boundary markers or sanitization logic are defined in the instructions to separate external content from agent instructions. However, the skill provides legitimate CRUD capabilities (e.g., invoices.create) necessary for its accounting functions, making this an inherent risk of the primary skill purpose.

zoho-books