The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill incorporates several features that ingest untrusted data from external sources, which could serve as vectors for indirect prompt injection.
Ingestion points: The agent is instructed to crawl multiple pages of prospect websites in references/research.md and import data from external CSV files or CRM exports in references/list.md and references/handover.md.
Boundary markers: The instructions do not define specific structural delimiters or provide explicit 'ignore' directives to the agent for the content retrieved from these external sources.
Capability inventory: The agent has access to powerful tools like bash, run_command, write_to_file, and replace_file_content, creating a high-privilege environment that could be targeted by successful injection attacks.
Sanitization: While the skill includes quality gates for data hygiene and business verification, it lacks explicit security sanitization or filtering logic for the text ingested from external websites or files.
[COMMAND_EXECUTION]: The skill utilizes high-capability tools including bash and run_command to perform legitimate research and file management tasks. The use of these tools, while necessary for the skill's intended purpose, increases the overall risk profile if the agent is exposed to malicious content through its data ingestion channels.

gtm