The Agent Skills Directory

[SAFE]: The skill implements strong input validation for all path-bearing flags and user-supplied strings (like dbt view names) before they are used in shell commands or API calls. This prevents path traversal and shell injection vulnerabilities.
[COMMAND_EXECUTION]: The skill uses Bash to execute local scripts (enrich_waterfall.py, verify_smtp.py). These scripts are part of the local worktree and are invoked using a secure wrapper (bw-run.sh) that manages API keys via environment variables rather than hardcoding them. Command arguments are either static or strictly validated against regex patterns (e.g., ^[a-z0-9_]+$).
[EXTERNAL_DOWNLOADS]: The skill uses gh api to read dbt model definitions from a known internal repository (Brite-Nites/brite-data-platform). This is a legitimate business operation for auditing purposes and uses a well-known service (GitHub) with neutral, informative documentation.
[DATA_EXFILTRATION]: No evidence of data exfiltration was found. Network operations are performed via authorized MCP tools for Salesforce, Email Bison, and enrichment providers. The skill includes a 'cost gate' that requires explicit user confirmation before executing paid enrichment operations if estimated costs exceed $20.
[PROMPT_INJECTION]: The skill does not contain instructions that attempt to bypass safety filters or override system-level agent behavior. It provides clear, functional instructions for lead generation tasks.
[CREDENTIALS_UNSAFE]: No hardcoded secrets were found. The skill documentation refers to API keys (e.g., BLITZAPI_KEY) as environment variables to be provided at runtime, following security best practices.

list-building