The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources which could contain malicious instructions designed to influence the agent's output during the personalization phase.
Ingestion points: Data is ingested via social_post_list_live (LinkedIn posts), job_search (job descriptions), and company_enrich (news articles) as documented in SKILL.md.
Boundary markers: The instructions do not define clear delimiters or specific warnings to ignore instructions embedded within the fetched external data.
Capability inventory: The skill has the ability to execute JavaScript via the execute tool and generate file artifacts (Campaign CSV) as detailed in the 'LIST MODE' and 'Crustdata tools used' sections.
Sanitization: While the skill implements a 'no-slop' rule to remove generic AI language, it does not explicitly sanitize or validate the content of the external signals against prompt injection attacks.
[DYNAMIC_EXECUTION]: The skill uses a pattern of generating and executing JavaScript snippets at runtime to interact with the Crustdata API.
Evidence: SKILL.md specifies that all tool calls run inside the execute tool of the Crustdata MCP server as plain JavaScript scripts.
Risk: Although these scripts are based on templates provided within the skill, runtime code generation is a dynamic execution pattern.

sales-outreach