The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill's dependency configuration references non-existent versions of several common Node.js packages and type definitions, which is a strong indicator of a supply chain attack or dependency confusion attempt.
The package.json and pnpm-lock.yaml files specify versions such as openai@7.5.0 (official latest is 4.x), node-cron@4.6.0 (official latest is 3.x), typescript@6.0.3 (official latest is 5.x), @types/node@24.13.3 (official latest is 22.x), accepts@2.0.0 (official latest is 1.3.x), and body-parser@2.3.0 (official latest is 1.20.x).
The lockfile entries for these packages often show an absence of expected sub-dependencies, further indicating that they are not legitimate versions of the referenced libraries.
Referencing futuristic or non-existent versions is a known technique for pulling malicious code into a project through dependency registries.
[INDIRECT_PROMPT_INJECTION]: AI-related recipes in the skill are vulnerable to indirect prompt injection due to the way they process external or CRM-managed data within LLM prompts.
Ingestion points: examples/08-ai-assistant.ts ingests CRM deal titles and activities; examples/09-web-search-llm.ts ingests results from external web searches.
Boundary markers: The skill uses basic textual headers (e.g., "Deal:", "Activities:", "Sources:") to separate data from instructions. These are insufficient to prevent an LLM from following instructions that may be embedded within the ingested data.
Capability inventory: The skill utilizes tasks.task.add and crm.timeline.comment.add to perform actions based on the LLM's response, providing a mechanism for automated exploitation if the prompt is subverted.
Sanitization: No logic for filtering, sanitizing, or escaping the input data before it is interpolated into the prompts was observed.

b24jssdk-recipes