The Agent Skills Directory

[DYNAMIC_EXECUTION]: The SKILL.md preamble contains shell commands that execute two Python scripts, telemetry/version_check.py and telemetry/telemetry_init.py, whenever the skill is started. These scripts are not included in the provided file list, representing an attempt to execute unverified code from the local environment.
[COMMAND_EXECUTION]: The scripts/cold-outbound-sender.py script uses the subprocess.run function to execute system commands for sending emails via a CLI tool. The command is built using the --cli-command argument, which could be manipulated to execute arbitrary commands if the agent's parameters are influenced by an attacker.
[INDIRECT_PROMPT_INJECTION]: The scripts/competitive-monitor.py utility is designed to scrape HTML from competitor pricing and blog pages to generate reports. This process creates a vulnerability surface where instructions embedded in external websites could influence the agent's behavior when it processes the resulting report.
Ingestion points: The fetch_url function in scripts/competitive-monitor.py retrieves content from arbitrary external URLs.
Boundary markers: No delimiters or safety warnings are included in the generated markdown report to separate untrusted scraped data from instructions.
Capability inventory: The skill suite includes capabilities for network requests, file modification, and shell command execution.
Sanitization: The script performs basic HTML tag removal but lacks robust filtering for natural language instructions embedded in the content.
[INDIRECT_PROMPT_INJECTION]: The scripts/cross-signal-detector.py script aggregates and analyzes data from multiple files in a shared output directory. This creates a multi-step attack surface where a malicious payload in one agent's output could compromise the subsequent analysis phase.
Ingestion points: The script reads all files within the directory specified by the DATA_DIR environment variable.
Boundary markers: None provided.
Capability inventory: Data aggregation and signal report generation.
Sanitization: None.
[PROMPT_INJECTION]: The iterative scoring workflow defined in SKILL.md Phase 2 uses "non-negotiable" language and mandates that the agent must iterate until a specific target score is reached. Such strict control flow instructions can be used to trap the agent in loops or override its standard operational guardrails.

cold-outbound-optimizer