The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection. It instructs the agent to ingest untrusted data from external sources using tools like mcp__coldiq__fetch_page_content (fetching website content) and mcp__coldiq__extract_post_engagement (fetching social media content) to personalize emails. There are no explicit instructions for the agent to sanitize this external content or use boundary markers to prevent embedded instructions in the fetched data from overriding the agent's behavior.
Ingestion points: External website content and social media posts are fetched via MCP tools into the agent's context (e.g., in SKILL.md, atl-messaging/SKILL.md).
Boundary markers: Absent; the instructions do not specify delimiters or warnings to ignore instructions within the fetched data.
Capability inventory: The agent can read local files, execute MCP tools, and generate outreach copy based on the aggregated data.
Sanitization: Absent; there is no mention of filtering or escaping external content before interpolation.
[REMOTE_CODE_EXECUTION]: The skill includes instructions for the user to execute remote code via npx to connect a tool: COLDIQ_API_KEY=<key> npx -y @coldiq/mcp@latest. While this package belongs to the skill's author (cold-iq), the use of npx to download and execute the latest version of a package from a remote registry is a common remote code execution pattern.
[COMMAND_EXECUTION]: The skill uses dynamic path resolution for its sub-skills. The orchestrator instructs the agent to use a Glob search to find SKILL_BASE and then construct paths to sub-skills (e.g., {SKILL_BASE}/.claude/skills/{sub-skill}/SKILL.md). While this is a local operation within the skill's directory, it relies on the agent's ability to compute and follow file paths dynamically.

cold-email