The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests prospect information from the Prospeo API and uses it to generate AI-based enrichment fields via OpenRouter in scripts/enrichments/ai-company-analysis.ts. These generated fields (e.g., ai_company_mission) are then interpolated into email templates sent to third parties. The prompts used for enrichment do not employ strict boundary markers or sanitization for external data (such as company names or descriptions), creating a surface where malicious content in a prospect's public presence could influence the generated email content.
Ingestion points: Prospect data retrieved via scripts/prospeo-full-export.ts and stored in local CSV files.
Boundary markers: No delimiters or explicit instructions to ignore embedded commands are used in the enrichment prompts.
Capability inventory: Automated email sending through Smartlead or Instantly APIs.
Sanitization: The skill lacks sanitization or validation of the lead data before it is included in LLM prompts.
[COMMAND_EXECUTION]: The toolkit includes several TypeScript scripts meant to be executed by the user to automate the campaign setup process. These scripts perform high-impact actions such as bulk domain registration on Dynadot and configuration of mailboxes. While these are core features, they involve automated command execution that requires careful user oversight.
[DATA_EXFILTRATION]: The skill manages data exchange with various well-known service providers, including Dynadot, Zapmail, Prospeo, Smartlead, and Instantly. It handles sensitive API keys using a local .env configuration file, which is a standard approach for developer-oriented automation tools. User leads and contact data are exported to local CSV files as part of the campaign workflow.
[EXTERNAL_DOWNLOADS]: The skill instructions guide users to install standard development tools and dependencies, such as Node.js and the tsx executor, which are required to run the provided automation scripts.

cold-email-starter-kit