The Agent Skills Directory

[DATA_EXPOSURE]: The skill maintains local state files in .agents/loops/ to ensure idempotency (preventing duplicate actions). This is a standard and safe practice for agent state management. The skill explicitly instructs against storing PII (Personally Identifiable Information) in these logs or state files in references/loop-guardrails.md.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data sources, such as news feeds (newsjacking loop), social media mentions (social-listening loop), and customer feedback (voice-of-customer loop). These represent an indirect prompt injection surface. However, the skill implements comprehensive mitigations:
Ingestion points: Data enters through news aggregators, social API integrations, and customer research tools mentioned in references/loop-catalog.md.
Boundary markers: The instructions mandate specific 'Self-checks' and 'Veto lists' (e.g., in the newsjacking loop) to validate data and fit before acting.
Capability inventory: The loops orchestrate channel-specific skills like emails, ads, and social to perform actions.
Sanitization: The skill enforces a 'two-tier action model' in references/loop-guardrails.md, which requires mandatory human approval (Tier 2) for any action that spends money, publishes content, or sends messages to users.
[COMMAND_EXECUTION]: The skill mentions platform-specific scheduling tools such as /loop, ScheduleWakeup, and CronCreate for the Claude Code environment. These are documented as standard methods for automation and do not involve unsafe command injection or unauthorized shell access.

marketing-loops