The Agent Skills Directory

[SAFE]: The skill primarily consists of documentation, integration guides, and templates for GTM platforms (HubSpot, Salesforce, Clay, etc.). All identified external links point to the vendor's own GitHub repository (github.com/LeadMagic/*), which is considered safe behavior for a vendor-authored skill.
[SAFE]: The execution script scripts/check-output.py is a benign utility that performs regex-based string matching to ensure generated reports contain required sections and terms. It does not perform any network operations, file writes, or dangerous system calls.
[SAFE]: Instructions regarding credentials correctly follow security best practices by advising the use of environment variables or secret stores rather than hardcoding keys (e.g., 'LeadMagic API key in env/secret store (never committed)').
[INDIRECT_PROMPT_INJECTION]: The skill acts on external data (CRM leads, form fills) which creates a surface for indirect prompt injection. However, the skill implements a 'Verification Gate' and explicit schema handling which acts as a natural boundary, and its primary purpose is data movement rather than complex reasoning on untrusted text. Severity is low.

leadmagic-integrations