The Agent Skills Directory

[DATA_EXPOSURE]: The skill reads the PSQUARED_CRM_TOKEN from a local .env file. This is a standard and recommended practice for secret management, avoiding hardcoded credentials within the script or instructions.
[COMMAND_EXECUTION]: The skill utilizes curl to interact with a GraphQL API at https://crm.psquared.dev/graphql. These operations are limited to standard API queries and mutations (fetching opportunities, creating campaigns, and updating records) consistent with the skill's stated purpose.
[INDIRECT_PROMPT_INJECTION]: The skill has a surface for indirect prompt injection as it processes data retrieved from the CRM (e.g., company names).
Ingestion points: CRM opportunity data retrieved in STEP 1.
Boundary markers: None explicitly defined for the external data processing.
Capability inventory: Network operations via curl to update CRM records.
Sanitization: No specific sanitization logic is mentioned for the data returned from the CRM, though the data is primarily used for filtering and display.

plan-campaign