The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest untrusted data from the web, including HTML, marketing tags, ad copy, and job descriptions, which are then processed by the AI agent. This creates a surface for indirect prompt injection.
Ingestion points: recon.py, gtm_parse.py, pricing.py, company.py, and history.py all fetch external content entering the agent's context.
Boundary markers: SKILL.md provides explicit instructions to the agent to treat ad copy and other web content as untrusted marketing claims and not as instructions to follow. It also mandates the use of confidence markers like [observed] and [inferred].
Capability inventory: The skill uses subprocess.run for curl and dig, and urllib for network requests.
Sanitization: The scripts parse content for data patterns rather than executing it, and the SKILL.md instructions guide the agent on safe interpretation.
[EXTERNAL_DOWNLOADS]: The scripts perform network operations to fetch data from target websites and various public APIs/services (e.g., Google, Meta, SEC EDGAR, Wayback Machine, and job boards). These are intended functionalities for the skill's purpose of marketing reconnaissance.
[COMMAND_EXECUTION]: Multiple scripts (recon.py, gtm_parse.py, history.py, pricing.py) use subprocess.run to execute curl, dig, or brotli. These commands are executed without a shell (shell=False), which mitigates command injection vulnerabilities. The arguments passed to these commands are derived from user-provided URLs or hostnames.
[DYNAMIC_EXECUTION]: The history.py script uses __import__ to dynamically load optional compression libraries (brotli or brotlicffi). The library names are restricted to a hardcoded list, making this use case safe.

growth-recon