The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to install the deepline package globally. It specifically provides a fallback command that uses a private NPM registry at https://code.deepline.com/api/v2/npm/, which is an unverifiable source outside of the standard public registries or trusted vendor lists.
[COMMAND_EXECUTION]: The skill executes multiple shell commands to set up the environment and run the deepline utility. This includes automated authentication flows (deepline auth register --wait auto and deepline auth wait) that interact with external services to obtain credentials.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to load and follow instructions from an external file located at ../deepline-gtm/recipes/portfolio-prospecting.md. Processing instructions from external files introduces a vulnerability where malicious content in those files could hijack the agent's behavior.
Ingestion points: The file SKILL.md explicitly directs the agent to read and follow the recipe at ../deepline-gtm/recipes/portfolio-prospecting.md.
Boundary markers: There are no boundary markers or instructions to ignore embedded commands when processing the external recipe file.
Capability inventory: The skill demonstrates the capability to execute shell commands (npm, deepline) as shown in the SKILL.md file.
Sanitization: No sanitization or validation logic is present to check the content of the external recipe before execution.

portfolio-prospecting