The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes data from external search results (job titles, person records) which are subsequently analyzed by an LLM for classification. This creates a surface for indirect prompt injection if an attacker-controlled profile contains malicious instructions.
Ingestion points: Search results returned by clay search filters-mode run in Step 2, which are then processed in Step 3.
Boundary markers: The instructions lack specific delimiters or warnings for the LLM when classifying potentially malicious job titles.
Capability inventory: The skill can execute clay CLI commands and perform local file read/write operations for session "answer sheets".
Sanitization: There is no evidence of sanitization or filtering of the search record fields before they are interpolated into the classification prompt.
[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using the clay CLI tool (e.g., clay whoami, clay search) to perform its primary function. These are vendor-provided tools from clay-run.
[METADATA_POISONING]: There is an inconsistency between the skill's metadata and its instructions. The YAML frontmatter declares touches: read-only, yet Step 1 instructions explicitly direct the agent to offer to save answers to a local file ("offer to save the answers back"). While the purpose appears benign, this mismatch between declared permissions and actual behavior is a metadata inconsistency.

find-decision-makers-at-company