The Agent Skills Directory

[SAFE]: The skill implements a structured, multi-phase workflow (INIT, REVIEW, FINALIZE) for generating strategic documents. It uses standard Model Context Protocol (MCP) integrations to access external data from trusted services like Stripe, Ahrefs, and Google Analytics.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data from a dedicated materials/ directory and various API responses. While this represents a theoretical attack surface for indirect prompt injection, it is necessary for the skill's primary function and standard for analytical agents.
Ingestion points: Client-provided files in the materials/ folder and data retrieved from external APIs (Ahrefs, GA4, Stripe, Customer.io, etc.).
Boundary markers: None explicitly defined for external content ingestion.
Capability inventory: File system writes (generating .md plans), network operations (via MCP and GitHub publishing), and tool execution (e.g., agent-browser).
Sanitization: No specific sanitization or filtering of external content is mentioned in the instructions.
[EXTERNAL_DOWNLOADS]: The skill documentation recommends the installation of agent-browser, which is a well-known tool for agentic browser automation. It does not perform unauthorized downloads or execute remote scripts in a dangerous manner.

marketing-plan