The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external data sources such as analytics logs, conversion touchpoints, and campaign URLs, creating an attack surface for indirect prompt injection. This risk is mitigated by the implementation of strict schema validation and PII scrubbing protocols (EVT-001 and EVT-002) within the event-collector.ts and utm-sanitizer.ts scripts.\n
Ingestion points: The skill reads JSON event files and URL strings via command-line arguments in its utility scripts.\n
Boundary markers: The skill uses structured JSON schemas and specific mode playbooks to constrain agent behavior.\n
Capability inventory: The skill uses run_command and write_to_file to manage data processing and artifact generation.\n
Sanitization: Extensive sanitization is present; the scrubPii function uses regex to redact emails, phone numbers, and secrets (e.g., sk-, ghp_, bearer) from all incoming data.\n- [SAFE]: The skill demonstrates a strong security posture by using industry-standard SHA-256 hashing for identity stitching in attribution-graph.ts, ensuring that PII is never stored in raw form. The 'Zero-Leak Telemetry Protocol' described in tracking.md explicitly forbids the transmission of source code, environment variables, or secrets.

analytics