The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill's configuration specifies a dependency on the @clawfu/mcp-skills Node.js package in the frontmatter. This package is identified as the required MCP server for the skill's functionality. Users should verify the integrity and source of this package before deployment as it originates from an unverified third-party author.
[INDIRECT_PROMPT_INJECTION]: The skill acts as an intermediary that processes external sales data provided by the user, which is a surface for indirect prompt injection.
Ingestion points: Opportunity details, account names, and champion profiles provided in natural language during deal review steps.
Boundary markers: The instructions mandate the use of structured markdown headers and tables for the output scorecard, providing some logical separation.
Capability inventory: The skill appears limited to text analysis and template generation; it does not explicitly invoke shell commands or write to the file system.
Sanitization: No validation or sanitization mechanisms are described to handle potentially malicious instructions embedded in the input deal data.
[METADATA_POISONING]: There is a discrepancy between the author identified in the skill context and the author field in the skill metadata ('ClawFu'). This inconsistency could be misleading regarding the skill's origin.

meddic-scorecard