The Agent Skills Directory

[PROMPT_INJECTION]: The skill is highly susceptible to indirect prompt injection because it ingests and processes untrusted data from external social media profiles (X and LinkedIn) and recent activity to score connections and draft messages.
Ingestion points: Connection inventory from X and LinkedIn, including profile data and recent activity (SKILL.md).
Boundary markers: The skill lacks explicit instructions for the agent to treat external profile data as untrusted or to ignore embedded instructions within bios or posts.
Capability inventory: Uses browser control and desktop automation to draft messages (Apple Mail, X DM, LinkedIn) and perform network pruning (SKILL.md).
Sanitization: No sanitization or validation of the ingested profile content is mentioned before it is used to influence scoring or drafting logic.
[COMMAND_EXECUTION]: The skill utilizes desktop automation for Apple Mail and browser control for platform analysis.
Evidence: Mentions 'Apple Mail or Mail.app drafting via desktop automation' and 'browser control for LinkedIn analysis and drafting' (SKILL.md).
Risk: This implies the generation and execution of local automation scripts (e.g., AppleScript) which could be manipulated if the agent is compromised via indirect injection.
[DATA_EXFILTRATION]: The skill handles highly sensitive user data, including private message drafts and professional network graphs.
Evidence: Accesses X DMs, LinkedIn messages, and Apple Mail contents for analysis and drafting (SKILL.md).
Risk: While the skill defaults to review-first, the capability to read and manipulate private communication channels via browser control creates a potential path for data exposure if the agent's instructions are overridden.

connections-optimizer