The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources such as prospect websites, forum threads, and social media posts via tools like Firecrawl and Browserbase. This creates an attack surface where malicious content on a scraped page could attempt to influence the agent's prospect scoring or outreach drafting.
Ingestion points: Web content extraction via Firecrawl, Browserbase, and social-fetch tools (referenced in references/demand-signals.md and references/local-prospecting.md).
Boundary markers: The skill lacks explicit technical delimiters (e.g., XML tags) for scraped content, though it emphasizes manual verification and cross-referencing to mitigate misinformation.
Capability inventory: The agent can write structured data to CSV files and draft outreach content based on the ingested signals.
Sanitization: No explicit sanitization or filtering of external content is described prior to analysis.
[COMMAND_EXECUTION]: The skill references a local CLI tool (node tools/clis/github-prospects.js) used to fetch and enrich data from GitHub stargazers and forks. This is a functional requirement for the SaaS prospecting motion and is executed locally using provided scripts.
[EXTERNAL_DOWNLOADS]: The skill integrates with well-known third-party services including Apollo, ZoomInfo, Clay, and Truelist for data enrichment and verification. These are recognized industry providers and their use aligns with the skill's stated purpose.
[DATA_EXPOSURE]: The skill is designed to collect and organize business contact information. It includes extensive compliance guidelines in references/compliance.md to ensure data is handled according to GDPR, CAN-SPAM, and CASL regulations, specifically advising against harvesting personal email addresses.

prospecting