The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external data that could contain malicious instructions.
Ingestion points: Fetches sales records and financial data from ~~бухгалтерия and ~~платежей (Step 1), and customer contact profiles and engagement markers from ~~crm (Step 3).
Boundary markers: No specific delimiters or "ignore instructions" markers are defined to separate untrusted data from the agent's logic, though it requires manual user confirmation between steps.
Capability inventory: The skill utilizes the Bash, WebFetch, and Read tools. It has the capability to write to ~~crm and ~~календаре.
Sanitization: There are no instructions to sanitize, escape, or validate the content of sales records, CSV uploads, or CRM data before it is interpolated into prompts or used for content generation.
[DATA_EXFILTRATION]: The skill accesses highly sensitive data categories as part of its primary workflow.
The instructions require access to financial records (accounting, payments, and bank-client CSV exports) and Personally Identifiable Information (PII) from CRM contacts.
The inclusion of the WebFetch tool allows for potential network communication, creating a path for data exposure if the agent is misled by malicious input data.
[COMMAND_EXECUTION]: The skill is configured with allowed-tools: Bash.
While the markdown instructions do not explicitly provide dangerous shell commands, the availability of a full shell environment (Bash) in a skill that processes unverified external financial and customer data significantly expands the attack surface for potential command injection or system exploration.

run-campaign