The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses python3 -c to extract credentials from a local JSON file and sets environment variables. It also utilizes curl extensively to interact with various API endpoints for data retrieval.
[CREDENTIALS_UNSAFE]: Accesses sensitive credential information stored in ~/.gooseworks/credentials.json. This is used to authenticate with the vendor's API proxy (api.gooseworks.ai). While this follows standard configuration practices for the vendor's tools, the use of a local credentials file is a sensitive operation.
[EXTERNAL_DOWNLOADS]: Interacts with multiple third-party services (Apollo, Fiber, Nyne, Scrapegraph, Tavily, Hunter, Tomba, Sixtyfour, and Brand.dev) to gather prospecting data and verify contact information.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection. It scrapes external content from various sources, including job boards (Tavily/Scrapegraph) and prospect websites (Scrapegraph smartscraper).
Ingestion points: Website content from {job_board_url}, {prospect_domain}, and {user_company_domain} ingested via Scrapegraph APIs in steps 4, 6, and 7.
Boundary markers: No explicit delimiters or warnings are used to separate untrusted web content from the agent's instructions.
Capability inventory: The skill possesses shell execution capabilities (curl) and file system read access (~/.gooseworks/credentials.json).
Sanitization: No sanitization or validation of the scraped text is performed before the agent processes it for intent analysis or competitive intelligence.

targeted-prospecting