The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted HTML files to identify interactive elements for event tracking.
Evidence: The workflow in Step 1 and Step 7 involves reading the complete HTML file and scanning for buttons, forms, and other elements to attach tracking logic.
Risk: Maliciously crafted content within the HTML (e.g., inside comments) could attempt to influence the agent's behavior during the setup process.
Sanitization: The skill uses predefined templates for script injection, which limits the impact of potential injection attacks from the processed file content.
[COMMAND_EXECUTION]: The skill uses file manipulation tools to modify the landing page code.
Evidence: The allowed-tools include write, edit, and bash for inserting analytics scripts and configuration files.
Scope: These tools are used to inject scripts for GA4, Meta Pixel, and Google Ads, as well as a custom JavaScript tracking system, which is consistent with the stated functionality.
[EXTERNAL_DOWNLOADS]: The skill configures the landing page to load scripts from external analytics providers.
Evidence: Scripts are loaded from www.googletagmanager.com and connect.facebook.net.
Context: These are well-known services commonly used for web measurement and conversion tracking. The skill uses standard implementation patterns provided by these vendors.

lp-analytics