The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied CSV and JSON engagement exports that could contain malicious instructions within job headlines or comments.
Ingestion points: Data is loaded from local files by scripts/engager_segmenter.py for aggregation.
Boundary markers: Strong defensive instructions in references/data-handling.md (§10, §12) and SKILL.md explicitly mandate that any instruction-like text within the export be treated as data strings and never as commands.
Capability inventory: The skill uses local Python scripts to calculate statistics. It lacks network access, dynamic code execution (eval/exec), or the ability to run shell commands based on data content.
Sanitization: The AI is instructed to ignore embedded directives and only produce aggregated reports that do not identify individuals.
[PROMPT_INJECTION]: Static detectors flagged defensive security language in references/data-handling.md. The identified text provides examples of common attack patterns (e.g., 'ignore previous rules') to explicitly instruct the agent to disregard them if found in input data, functioning as a safeguard rather than an injection.
[DATA_EXFILTRATION]: While the skill handles PII (names, titles), it incorporates strict privacy-by-design principles. It enforces local processing, data minimization (stripping unneeded columns), and ensures that output remains aggregate-only (e.g., suppressing company names associated with only one person) to prevent individual identification or exfiltration.

linkedin-engagement-analytics