The Agent Skills Directory

[PERSISTENCE]: The skill's documentation in references/profile-and-onboarding.md instructs users to modify their shell configuration files (such as ~/.bashrc or ~/.zshrc) to persist the NIMBLE_API_KEY environment variable. While this is a standard configuration practice for CLI tools, it is classified as a persistence mechanism that modifies user startup profiles.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external sources, including Google Sheets, CSV files, and inline text, for business auditing purposes.
Ingestion points: External data is ingested through the "Audit Mode" logic described in SKILL.md (Step 1) and references/audit-mode.md (parsing Google Sheets and CSVs).
Boundary markers: The instructions lack explicit prompt boundaries or "ignore instructions" warnings to encapsulate the external data, which could allow malicious content within these files to influence the agent's behavior.
Capability inventory: The skill has access to sensitive capabilities including file writing (Write), file editing (Edit), and spawning sub-agents (Agent).
Sanitization: Normalization processes are focused on data formatting (e.g., stripping non-digits from phone numbers) and do not provide protection against natural language prompt injection.
[COMMAND_EXECUTION]: The skill uses various shell tools (cat, mkdir, jq, ls) and inline Python scripts for project management, data storage, and environment validation.
[EXTERNAL_DOWNLOADS]: The skill provides instructions for installing the nimble-cli package via npm. As this tool is provided by the authoring organization (nimbleway), it is considered a legitimate vendor-owned resource.

market-finder