The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from multiple external sources including emails, support tickets, and web reviews. This creates a risk where malicious instructions embedded in those sources could be executed by the agent during analysis.
Ingestion points: Data is pulled from CRM (HubSpot/Salesforce), Email (Gmail), Support tickets (Zendesk/Intercom), and Web reviews (G2/Capterra) as described in Step 1 and Step 2 of SKILL.md.
Boundary markers: The skill lacks explicit instructions to ignore or delimit potentially malicious text inside the data it processes; it only mentions scrubbing PII from quotes.
Capability inventory: The skill utilizes Bash, Write, WebFetch, and Agent tools, which could be leveraged if an injection succeeds.
Sanitization: No sanitization or filtering logic is mentioned for instructions, only anonymization of PII.
[DATA_EXFILTRATION]: The skill is intended to access highly sensitive information including revenue data (Stripe), internal databases (Postgres), and customer communication. Although it mandates "Read-only by default," the combination of WebFetch and Bash capabilities alongside access to sensitive environment variables ($SUPABASE_TOKEN, $OPENAI_API_KEY) presents a high-value target for exfiltration if the agent's behavior is subverted.
[COMMAND_EXECUTION]: The inclusion of the Bash tool in the allowed tools list permits the agent to execute shell commands. This capability, while useful for data processing, increases the impact of potential injection attacks.

icp-deep-scanner