The Agent Skills Directory

[COMMAND_EXECUTION]: The script ig-dm-browser.js executes an external CLI tool named clawdbot via execSync to manage browser sessions. This tool is not a standard system utility or a listed dependency, presenting a risk if the tool originates from an untrusted source.
[DATA_EXFILTRATION]: In ig-dm-browser.js, the script explicitly disables TLS/SSL certificate validation globally by setting process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0". This bypasses standard security protocols and makes the browser automation session vulnerable to Man-in-the-Middle (MitM) attacks, potentially exposing session cookies or credentials. Additionally, multiple scripts access sensitive files like .env and onboarding-config.json via relative path traversal outside the skill's own directory.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection in instagram_dm_sales_agent.py within the generate_ai_message function.
Ingestion points: Data is ingested from the instagram_leads PostgreSQL table, specifically the username, full_name, and campaign fields.
Boundary markers: The system prompt for AI personalization does not employ delimiters or guardrails to isolate lead data from the instructions.
Capability inventory: The agent utilizes Playwright for web automation, connects to external LLM APIs (Anthropic), and has read/write access to a database.
Sanitization: There is no evidence of sanitization or validation of the database fields before they are interpolated into the prompt sent to the LLM.

instagram-dm-sales-agent