The Agent Skills Directory

[SAFE]: The skill consists entirely of instructional markdown and reference data. It does not contain any executable scripts, shell commands, or obfuscated payloads. No malicious patterns or security risks were identified within the instructions or templates provided.\n- [NO_CODE]: This is a documentation-only skill. No code files (Python, JavaScript, shell scripts) are included in the skill package, which prevents common attack vectors such as remote code execution or unauthorized system access.\n- [INDIRECT_PROMPT_INJECTION]: The skill instructions prompt the agent to read project-specific context from local files such as .agents/product-marketing.md. This represents a potential surface for instructions to enter the agent's context from external data.\n
Ingestion points: The skill explicitly directs the agent to read .agents/product-marketing.md, .claude/product-marketing.md, or product-marketing-context.md if they exist in the project structure.\n
Boundary markers: No explicit markers or instructions to ignore embedded commands are present in the guidelines for reading these files.\n
Capability inventory: The skill does not provide the agent with any dangerous tools or capabilities, such as file-writing or network-send operations, which mitigates the risk of this injection surface.\n
Sanitization: No sanitization or validation logic is defined for the content of the ingested marketing context files.\n- [EXTERNAL_DOWNLOADS]: The skill includes links to external tools and guides hosted on GitHub and official domains of well-known services like Apple and HubSpot. These references are documented for user information and do not trigger automated downloads or execution of remote code.

co-marketing