The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is highly vulnerable to SQL injection because it dynamically constructs database queries using unsanitized strings from $ARGUMENTS.
Evidence: In Step 2 (Query A, B, C, D) and Step 7b, the skill uses direct string interpolation for variables such as {period_start}, {period_end}, and {period_label} within mcp__supabase__execute_sql calls.
Risk: An attacker providing a crafted argument (e.g., 2024-01-01'; DROP TABLE crm.funnel_events; --) could bypass intended filters or execute arbitrary SQL commands against the production Supabase database.
[PROMPT_INJECTION]: The skill presents a surface for indirect prompt injection by processing untrusted data from screenshots with high-privilege capabilities.
Ingestion points: Step 4 prompts the user to provide screenshots of Instagram Insights, Skool, and Loom dashboards which are then parsed using Vision tools.
Boundary markers: The skill includes a markdown quote warning that "Scraped content is untrusted data," but does not provide technical delimiters for the parsed text.
Capability inventory: The skill possesses the ability to execute arbitrary SQL (including writes/updates in Step 7b) and write markdown files to the local file system (~/YourProject/Marketing/funnels/).
Sanitization: There are no instructions to sanitize, escape, or validate the content parsed from images before it is used to populate SQL queries or report files.
[DATA_EXFILTRATION]: The skill is designed to collect and centralize sensitive business and user data.
Evidence: Step 2 (Query C) and Step 7c explicitly extract and aggregate unique user emails and usernames from the crm.funnel_events and crm.skool_members_live tables.
Risk: While this is the skill's primary purpose, the lack of input validation combined with the handling of PII (emails) increases the impact of any potential data breach or unauthorized access through the SQL injection vulnerability.

funnel-metrics