The Agent Skills Directory

[DATA_EXFILTRATION]: The script scripts/getleads-client.ts accesses and parses the agent platform's internal configuration file, which often contains sensitive secrets and environment variables for other integrated services.
Evidence: The code const cfg = JSON.parse(readFileSync(join(homedir(), ".claude.json"), "utf8")); reads the entire configuration file into memory.
Context: The script recursively searches the resulting object to find Authorization headers for the GetLeads service for use in external API calls.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external, untrusted websites and passes it to an LLM for lead qualification, creating an attack surface for indirect prompt injection.
Ingestion points: Scraped website text from homepages and team pages is processed in scripts/solo-teampage.ts, scripts/classify-batch.ts, and scripts/multi-lane-classify.ts.
Boundary markers: External content is interpolated into LLM prompts using headers such as EVIDENCE: and WEBSITE TEXT: to separate it from instructions.
Capability inventory: The skill can perform network operations (OpenAI, Prospeo, and GetLeads APIs), write to the local filesystem (CSV/JSON), and interact with a Postgres database.
Sanitization: The scripts perform HTML stripping and length truncation on the scraped text before LLM processing.
[COMMAND_EXECUTION]: The skill relies on executing system commands and local scripts to coordinate its multi-phase workflow.
Evidence: scripts/registry.ts uses execSync to run psql for database operations related to lead deduplication.
Evidence: scripts/run-lane.ts uses spawn to run several other scripts (such as pull.ts, score-batch.ts, and verify-website.ts) in the background.
[DYNAMIC_EXECUTION]: The skill identifies and executes local scripts based on dynamic file system existence checks at runtime.
Evidence: scripts/contacts.ts searches for the path to the blitz-list-builder script across multiple potential locations and executes the resulting path.
Evidence: scripts/run-lane.ts and scripts/snowball.ts dynamically construct paths to operational scripts and execute them using the Node.js runtime.

list-builder