The Agent Skills Directory

[DATA_EXFILTRATION]: The skill's diagnostic script fetches raw JSON data from Hootsuite API endpoints (/v1/me, /v1/socialProfiles, and /v1/messages). This data contains account-specific metadata and potentially social media post content. Although the skill includes explicit instructions for the agent to redact sensitive fields (such as post copy, handles, and audience data) before the bundle is packaged and exported, the collection script itself does not automate this redaction, creating a window where raw data is present in the local environment.- [INDIRECT_PROMPT_INJECTION]: The skill ingests external content from social media post feeds via the Hootsuite API. This content is untrusted and could theoretically contain malicious instructions aimed at influencing the agent during the diagnostic process.
Ingestion points: API responses from Hootsuite stored in scheduled-posts.json (via the /v1/messages endpoint).
Boundary markers: No explicit delimiters or boundary markers are used in the data collection scripts to separate external content from system instructions.
Capability inventory: The skill uses curl for network access, tar and mkdir for file system operations, and Bash for command execution.
Sanitization: The instructions require the agent to apply a redaction policy and verify the absence of sensitive content before packaging the final bundle.

hootsuite-debug-bundle