The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses python3 for configuration processing and curl for API interactions. Specifically, it executes python3 -c to extract keys from the local credentials.json file.
[EXTERNAL_DOWNLOADS]: The skill instructions and metadata reference npx commands for installation and login (goose-skills, gooseworks), which involve fetching packages from the public npm registry.
[DATA_EXFILTRATION]: The skill transmits search parameters such as industries, employee counts, and job titles to api.gooseworks.ai. This communication is necessary for the skill to perform its lead generation functions.
[CREDENTIALS_UNSAFE]: The skill accesses ~/.gooseworks/credentials.json to retrieve the GOOSEWORKS_API_KEY. While this involves reading a credential file, it is restricted to the specific configuration file for the service the skill is designed to use.
[PROMPT_INJECTION]: The skill exhibits a potential surface for indirect prompt injection by ingesting and processing data from external search and validation APIs without explicit safety boundaries.
Ingestion points: Data returned from fiber, hunter, sixtyfour, and brand-dev APIs through the Gooseworks proxy.
Boundary markers: None identified; external data is processed directly within the workflow.
Capability inventory: The agent can execute network requests (curl) and read specific local configuration files.
Sanitization: There is no explicit logic for validating or escaping the content retrieved from external API responses before it is used by the agent.

sales-prospecting