The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes data from Pipedrive CRM records (deals, notes, person details) which can be modified by external parties or contain untrusted content. This creates a surface for indirect prompt injection attacks where malicious instructions hidden in CRM fields could influence the agent's behavior.
Ingestion points: Data enters the context via tools like PIPEDRIVE_GET_DETAILS_OF_A_DEAL, PIPEDRIVE_GET_ALL_NOTES, PIPEDRIVE_SEARCH_PERSONS, and PIPEDRIVE_GET_DETAILS_OF_A_PERSON (SKILL.md).
Boundary markers: Absent. The instructions do not specify the use of delimiters or 'ignore embedded instructions' warnings when the agent interprets content from CRM records.
Capability inventory: The skill possesses extensive write and delete capabilities, including PIPEDRIVE_ADD_A_DEAL, PIPEDRIVE_UPDATE_A_PERSON, PIPEDRIVE_DELETE_A_PERSON, and PIPEDRIVE_ADD_A_NOTE across multiple scripts and workflows.
Sanitization: While the documentation notes that HTML content in PIPEDRIVE_ADD_A_NOTE is sanitized server-side by Pipedrive, there is no evidence of prompt-level sanitization or filtering to prevent the agent from executing instructions found within the data.

pipedrive-automation