The Agent Skills Directory

[SAFE]: The skill uses standard API interactions with the official vendor domain api.bolna.ai. Credentials are managed through environment variables (BOLNA_API_KEY), which is a recommended security practice for secret management. No malicious code, obfuscation, or unauthorized data exfiltration patterns were detected in the scripts or documentation.
[PROMPT_INJECTION]: The ingest_source_config feature documented in references/caller-identification.md allows the agent to ingest external data (from APIs, CSVs, or Google Sheets) and interpolate it into prompts for personalization. This represents an indirect prompt injection surface if the third-party data source is compromised.
Ingestion points: External data sources (API endpoints, CSV files, or Google Sheets) as described in references/caller-identification.md.
Boundary markers: The provided documentation does not explicitly define specific delimiters for separating the interpolated variables from the main prompt instructions.
Capability inventory: The ingested data is primarily used for prompt variable substitution (e.g., {first_name}, {plan}) within the conversational agent.
Sanitization: The skill includes clear security warnings advising users against placing sensitive PII in public Google Sheets and recommends the use of the Internal API source for environments requiring higher security controls.

setup-inbound