The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from multiple external sources which could contain malicious instructions designed to influence agent behavior.
Ingestion points: Campaign names, ad group names, and UTM tags from Google Ads, Meta, LinkedIn, etc.; deal properties and notes from CRM platforms like HubSpot, Pipedrive, and Upsales; and content from brain/evidence/customer-language/latest.
Boundary markers: The instructions do not specify any delimiters or safety warnings (e.g., 'ignore embedded instructions') when processing or displaying these external strings.
Capability inventory: The skill possesses significant capabilities including writing to the agent's context (write_context_node), executing SQL queries (execute_bigquery_sql), and creating tickets or findings (create_ticket, create_finding).
Sanitization: There is no mention of sanitizing or escaping external content before it is interpolated into reports or used in folder/file creation.
[DYNAMIC_EXECUTION]: The skill employs techniques to generate and execute code at runtime to automate marketing workflows.
Script Generation: The 'Steps — sync' section instructs the agent to offer the creation of a daily create_script to perform deterministic data synchronization. While it suggests creating the script in a 'disabled' state for a 'dry-run', generating executable code from interpreted instructions is a known attack surface.
SQL Injection Risk: The tool mcp__cogny__execute_bigquery_sql is used to interact with data. If campaign IDs or other external identifiers are not properly sanitized before being included in SQL statements, it could lead to SQL injection vulnerabilities.
[COMMAND_EXECUTION]: The skill instructs the agent to perform complex operations across dozens of ad and marketing platforms. While these are authenticated via the 'Cogny' gateway, the breadth of access (spend, leads, revenue) makes the operational commands high-impact if the agent is manipulated by injected data.

campaign-ledger