The Agent Skills Directory

[NO_CODE]: The skill is composed entirely of Markdown instruction files and YAML configuration. It does not include any Python scripts, Node.js code, shell scripts, or binary executables, which eliminates common code-based attack vectors such as remote code execution or persistence.
[INDIRECT_PROMPT_INJECTION]: The skill operates by processing external project briefs and research data, which creates a technical surface for indirect prompt injection. A malicious brief could theoretically attempt to hide instructions to influence the agent's output. However, the skill incorporates mitigation by routing the generated content through a validation and editing pipeline (inboundfy-copy-editor and inboundfy-validador-infografico) that checks for prohibited patterns and ensures factual consistency.
Ingestion points: Ingests infographic briefs (e.g., in briefs/*.md) and project data files (e.g., in .inboundfy/context/).
Boundary markers: The skill does not define specific technical delimiters (like XML tags) for the input data, relying instead on its internal workflow rules.
Capability inventory: Capabilities are restricted to file system read access for project documents and the creation of Markdown artifacts. The skill does not have network access or the ability to execute arbitrary shell commands.
Sanitization: The output is audited by the framework's internal editor tool to filter out forbidden structures and ensure the content remains factual and short as per the canal specification.

inboundfy-especialista-infografico