The Agent Skills Directory

[SAFE]: The skill is designed for professional marketing automation and follows standard operational patterns for its stated purpose. It correctly identifies and uses environment variables for sensitive API keys (e.g., Ahrefs), which is a security best practice.- [DATA_EXPOSURE]: The skill interacts with sensitive business metrics (Stripe revenue, GA4 traffic, GitHub repositories) and file systems (~/marketing-plans/). However, this access is strictly within the scope of its primary function as a fractional CMO planning tool and is managed through authorized tool interfaces.- [PROMPT_INJECTION]: The skill analyzes external client-provided documents (decks, transcripts, research) in the materials/ directory. This constitutes an indirect prompt injection surface. The instructions do not mandate specific delimiters or sanitization for this external data, but this is a common characteristic of document-analysis skills and does not represent a malicious intent in this context.

marketing-plan