The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell commands to initialize and run the approval gate tool, specifically npm install and npm run gate within a local application directory (apps/typescript/phone-approval-gate).
[EXTERNAL_DOWNLOADS]: Running npm install fetches necessary dependencies from the npm registry. These are treated as safe interactions with a well-known service for the purpose of running the vendor-provided tool.
[PROMPT_INJECTION]: The skill processes untrusted data in the form of call summaries and transcripts which could contain malicious instructions (indirect prompt injection). The skill successfully mitigates this risk by providing the agent with explicit instructions to treat all transcript data as untrusted and to never follow instructions embedded within the call content.
[CREDENTIALS_UNSAFE]: The skill demonstrates safe credential handling by instructing the agent to use environment variables for the CALLE_API_KEY and explicitly forbidding the printing or logging of this key.
[DATA_EXFILTRATION]: While the skill handles phone numbers and sensitive request details, it follows privacy best practices by instructing the agent to mask numbers in the UI and stores audit records locally. Communications are directed to the vendor's own service (CALL-E) as part of the intended functionality.

deployment-approval-call