The Agent Skills Directory

[PROMPT_INJECTION]: The skill is highly vulnerable to Indirect Prompt Injection because it automatically ingests and processes untrusted data from the open web and social media platforms. Malicious content hosted on a scraped website could attempt to redirect the agent's logic or influence the generated sales proposals.
Ingestion points: Data enters the system via scrapeWebsite(url), extractBrandColors(url), and the Instagram API (fetching follower usernames and names).
Boundary markers: The documentation does not specify the use of delimiters or instructions to ignore embedded prompts within the scraped HTML or social media metadata.
Capability inventory: The skill has access to the Anthropic Batch API for content generation, SerpAPI for web research, and WhatsApp for outbound notifications to the 'SuperSeller' group.
Sanitization: There is no mention of sanitizing, filtering, or validating the scraped HTML or CSS before it is passed to Claude Haiku for niche and city extraction.
[DATA_EXFILTRATION]: The architecture creates a chain where sensitive data (scraped content, business research, and follower data) is collected and subsequently transmitted to external channels like WhatsApp. If an indirect prompt injection attack succeeds, this pathway could be abused to exfiltrate internal system data or database records to the WhatsApp group or external APIs.
[PROMPT_INJECTION]: The skill utilizes an 'Engagement Bridge Classification' system that categorizes individuals as 'hostile' or 'ally' based on political slogans and movements (e.g., 'Iran freedom movement', 'anti-Israel'). This represents a form of metadata-driven bias that could be manipulated if an attacker modifies the safety_classification_rules database table or social media profile descriptions.

prospecting-revenue