The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill's integration instructions (Step 11) guide the agent to wire up services like Mailchimp, ConvertKit, and HubSpot using API keys. The process specifically suggests using fetch() calls within the landing page code. Because landing pages are client-side assets, following these instructions would result in exposing sensitive API keys to any visitor who views the page source.
[EXTERNAL_DOWNLOADS]: The skill generates JavaScript code intended to perform network operations to external services including Mailchimp, ConvertKit, and HubSpot for lead submission. While these are well-known technology providers, the data transmission occurs via the client's browser to these external endpoints.
[PROMPT_INJECTION]: The skill demonstrates an indirect prompt injection vulnerability by reading and auditing existing user landing page files (HTML, JSX, Vue, Astro) to identify insertion points and design systems.
Ingestion points: The skill reads landing page content using read, grep, and glob tools.
Boundary markers: There are no instructions or delimiters defined to prevent the agent from being influenced by malicious instructions embedded within the analyzed files.
Capability inventory: The skill possesses powerful capabilities including bash command execution and the ability to write and edit files in the local environment.
Sanitization: There is no evidence of sanitization or filtering of the content extracted from the target files before it is used to generate or modify code.

lp-leads