The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through the ingestion and processing of untrusted lead data.
Ingestion points: The skill retrieves lead data from the people table in Supabase and accepts data via CSV imports. Specifically, fields like comment_snippet (LinkedIn comments), job_posting_detail, and pain_topic are sourced from external, potentially attacker-controlled environments.
Boundary markers: There are no explicit delimiters or instructions provided in the sequence templates (e.g., in templates/sequence-templates/pain-language.md) to prevent the agent from obeying instructions that might be embedded within the lead data variables.
Capability inventory: The skill has the capability to write files to the local filesystem (CSV export in skills/linkedin-outreach/output/) and perform network operations via the Supabase API to log outreach attempts and update lead records.
Sanitization: The skill lacks mechanisms to sanitize or validate the content of interpolated variables before they are used to generate LinkedIn messages. While the primary risk is the generation of malicious message content, an attacker could potentially use crafted lead data to influence the agent's behavior during the campaign building process.

linkedin-outreach