The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructions advise installing the @membranehq/cli package from the NPM registry and using npx to execute connection commands. These are official tools belonging to the vendor's ecosystem for managing integrations.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from Zoho CRM modules (e.g., Leads, Contacts, Notes), which could potentially contain malicious instructions if the CRM content is controlled by an external actor.
Ingestion points: Records are retrieved through actions such as list-records, get-record, search-records, query-records, and get-note as documented in SKILL.md.
Boundary markers: There are no instructions or delimiters provided to the agent to treat external CRM data as potentially unsafe or to ignore embedded commands.
Capability inventory: The skill is capable of executing shell commands via the membrane CLI and performing network requests through the membrane request functionality.
Sanitization: The documentation does not specify any sanitization, filtering, or validation processes for the data retrieved from the Zoho CRM API.

zoho-crm