The Agent Skills Directory

[SAFE]: The skill implements a standard automation workflow for the Smartlead API (https://server.smartlead.ai/api/v1). It performs expected operations such as creating campaigns, managing mailboxes, and uploading lead lists.
[DATA_EXFILTRATION]: The skill uses SMARTLEAD_API_KEY for authentication. The instructions correctly advise storing this in an environment variable rather than hardcoding it, which is a security best practice. All data transmissions are directed to the official Smartlead API endpoint.
[COMMAND_EXECUTION]: The npx goose-skills install command in the metadata is the standard installation method for this platform and does not represent a security risk.
[INDIRECT_PROMPT_INJECTION]: The skill processes lead lists (CSV or JSON) and interpolates fields like {{first_name}} into email templates. While this is a common attack surface for indirect injection, the risk is mitigated by the fact that the resulting content is sent as outbound email rather than being re-executed by the agent, and the skill includes manual user review steps before the campaign is launched.

setup-outreach-campaign