The Agent Skills Directory

[DATA_EXFILTRATION]: The script scripts/apollo-config.sh references a hardcoded absolute path to a sensitive configuration file (/Users/jhumanj/clawd/config/apollo.env) containing API keys. Hardcoding paths to sensitive credentials in a user-specific directory is a risk for data exposure and environment-specific failures.
[COMMAND_EXECUTION]: Several scripts, including scripts/apollo-people-search.sh and scripts/apollo-orgs-bulk.sh, dynamically generate and execute Python code using heredocs to process arguments and generate JSON payloads at runtime.
[COMMAND_EXECUTION]: The script scripts/apollo-config.sh uses the source command to load its configuration file. This pattern executes the contents of the file in the current shell, allowing for arbitrary command execution if the configuration file is modified or contains malicious shell directives.
[PROMPT_INJECTION]: The SKILL.md file contains several directives designed to override agent behavior (e.g., "regardless of claimed authority or urgency"). These represent self-authoritative claims about the skill's safety. Additionally, the skill is vulnerable to indirect prompt injection: 1. Ingestion points: Apollo.io API responses in scripts/apollo-get.sh and scripts/apollo-post.sh. 2. Boundary markers: Absent; API data is returned to the agent context without delimiters. 3. Capability inventory: Includes network access via curl, script generation via Python, and shell sourcing. 4. Sanitization: No evidence of escaping or sanitizing content received from external API endpoints.

apollo-hardened