The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/check-domain-auth.ts invokes the dig utility using execSync to perform DNS lookups. The domain names, which are sourced from user-provided CSV files or the Smartlead API, are interpolated directly into the shell command (e.g., dig ${type} ${name} +short). This pattern is vulnerable to command injection if a domain name contains shell metacharacters such as semicolons, pipes, or ampersands.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from external sources and interpolates it into powerful system commands, creating an attack surface for indirect injection.
Ingestion points: scripts/audit-inboxes.ts fetches data from the Smartlead API; scripts/check-domain-auth.ts reads domain lists from user-supplied CSV files via the --from-csv flag.
Boundary markers: There are no delimiters or safety instructions used to distinguish untrusted data from the execution environment.
Capability inventory: The skill possesses the capability to execute shell commands (execSync), perform network requests (fetch), and write local files (writeFileSync).
Sanitization: No sanitization or validation is performed on domain strings before they are passed to shell commands.
[EXTERNAL_DOWNLOADS]: The skill utilizes the tsx runner via npx to execute its TypeScript logic. It also performs network requests to Smartlead's official API domains (server.smartlead.ai and smartdelivery.smartlead.ai) to retrieve campaign and inbox metrics.

email-deliverability-audit