The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted data from inbound-lead-data, specifically chatbot_conversations and raw_message fields from lead forms. This untrusted content is ingested into the agent's context and used to drive subsequent actions like web searches and email drafting without explicit boundary markers or instructions to ignore embedded commands.
Ingestion points: inbound-lead-data sourced from external CRM tools, Typeform, and chatbot transcripts (HubSpot, Salesforce, Intercom, etc.) as described in SKILL.md.
Boundary markers: Absent. The instructions do not specify delimiters or safety prompts to isolate lead-provided text from agent instructions.
Capability inventory: web-search, contact-enrichment, email-drafting, Supabase client access, and local file writing (CSV export).
Sanitization: None detected; the skill normalizes data into a schema but does not filter for malicious instruction patterns.
[DATA_EXFILTRATION]: The skill is designed to handle sensitive Personally Identifiable Information (PII), including lead names, emails, and professional titles. It accesses private organizational data from CRMs (Salesforce, HubSpot) and internal databases (Supabase). While data is stored locally in the clients/ directory, the integration with external enrichment services and web search tools creates a potential path for data exposure if not managed within secure environments.
[EXTERNAL_DOWNLOADS]: The skill performs network operations to pull data from various third-party lead sources (CRM APIs, form tools) and enrichment providers (Apollo, LinkedIn scraper). It also utilizes automated web searches to gather company context.
[COMMAND_EXECUTION]: The skill instructions mention utilizing calendar tools such as gcalcli or similar CLI utilities to inject availability into email drafts, which involves the execution of shell commands based on the triage output.

inbound-lead-triage