The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local Python scripts (scripts/appmate_config.py and scripts/growth_strategy.py) to manage configurations and process market data. The second script takes a user-provided app name as an argument.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8) because it incorporates untrusted external data into the agent's context for reasoning. (1) Ingestion points: Processes app reviews from data/apps_full.json and competitor metadata from data/competitors_slug.json. (2) Boundary markers: No explicit delimiters or instructions are provided to the agent to treat external content as untrusted data or to ignore potential instructions embedded within them. (3) Capability inventory: The agent can execute shell commands via local Python scripts and has file-write access to the data/ directory. (4) Sanitization: The workflow lacks evidence of content sanitization or validation of the text retrieved from reviews and competitor profiles before use in strategy generation.

growth-strategy