The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads the @vibeprospecting/vpai package from the public npm registry during initialization and execution phases using the npx command.
[REMOTE_CODE_EXECUTION]: The instructions direct the agent to execute npx @vibeprospecting/vpai@latest, which fetches and runs remote code at runtime. Using the @latest tag means the executed code version is unpinned and could change between runs.
[COMMAND_EXECUTION]: The skill relies on multiple shell commands to perform its core functions, including matching prospects (match-prospects), enriching data (enrich-prospects), and fetching career events (fetch-prospects-events).
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests data from external sources and processes it into natural language synopses.
Ingestion points: Enriched profile data and career events fetched from the Vibe Prospecting API and saved in people-enriched.csv (as described in Phase 4 and 5).
Boundary markers: The instructions do not define any boundary markers or delimiters to separate the external data from the agent's instructions during the synopsis generation phase.
Capability inventory: The skill possesses capabilities for shell command execution (via npx) and local file system access (reading and writing CSV files).
Sanitization: There is no evidence of sanitization or validation of the data retrieved from the external enrichment API before it is passed to the language model for synthesis.

contact-research