The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill requires the installation of the @curviate/cli package via npm to provide its core functionality. This is a standard dependency for the tool's operation.
[COMMAND_EXECUTION]: The skill operates by executing shell commands through the curviate binary to interact with LinkedIn profiles, companies, and search parameters. This includes both read and write operations.
[CREDENTIALS_UNSAFE]: The skill handles LinkedIn API keys and session information. It provides clear instructions for secure management, specifically recommending the use of environment variables (e.g., CURVIATE_API_KEY) to avoid exposing secrets in command-line arguments or shell history.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function involves ingesting and processing untrusted external data from LinkedIn profiles, activity feeds, and company pages.
Ingestion points: Data is fetched via commands such as curviate profile <id> and curviate company <id> posts (found in SKILL.md).
Boundary markers: There are no explicit instructions for the agent to use delimiters or ignore instructions that might be embedded in the retrieved LinkedIn content.
Capability inventory: The skill possesses write capabilities that could be abused if an injection is successful, including curviate profile update and curviate company reply (found in SKILL.md).
Sanitization: The documentation does not specify any sanitization or filtering of the external LinkedIn data before it is presented to the agent.

curviate-profile