The Agent Skills Directory

[SAFE]: The skill is a legitimate lead generation toolset. It requires API keys for X (Twitter) and Exa, which are standard for its described purpose of social graph analysis and deep web search.
[COMMAND_EXECUTION]: While the agents use the Bash tool, the instructions focus on using standard search utilities and social media API calls. There are no patterns of arbitrary command execution or privilege escalation.
[DATA_EXFILTRATION]: The skill processes user connection data and prospect data, but it is confined to the intended workflow of lead qualification and outreach drafting. No unauthorized exfiltration to third-party attacker domains was detected. The use of environmental variables for secrets (e.g., X_BEARER_TOKEN) follows standard security practices.
[REMOTE_CODE_EXECUTION]: There are no patterns of downloading and executing remote scripts (e.g., curl | bash). All dependencies are handled through the agent's defined environment.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data from web searches and social media. The instructions include constraints to only report verified data and avoid 'AI slop', which serves as a basic guardrail against incorporating malicious instructions from ingested content, though the inherent surface for indirect injection exists at a low level as in any RAG-based tool.

lead-intelligence