The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill implementation utilizes standard, well-known Node.js packages including intercom-client, lru-cache, and p-queue to perform its optimization tasks.
[CREDENTIALS_UNSAFE]: The skill follows security best practices by explicitly directing the user to store the INTERCOM_ACCESS_TOKEN in an environment variable and providing code examples that read from process.env rather than hardcoding sensitive credentials.
[INDIRECT_PROMPT_INJECTION]: The skill represents an indirect prompt injection attack surface as it ingests data from external sources.
Ingestion points: The code in references/implementation.md uses client.contacts.list, client.contacts.find, and client.contacts.search to ingest data from the Intercom API into the agent's context.
Boundary markers: No explicit boundary markers or instructions to ignore embedded instructions are present in the processing logic.
Capability inventory: The skill is scoped to performing network requests to the official Intercom API domain (api.intercom.io). It does not contain capabilities for file system modification, subprocess execution, or arbitrary network access.
Sanitization: There is no evidence of sanitization or schema validation for the data returned from the API; however, the skill's primary purpose is data retrieval and performance management.

intercom-performance-tuning