The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill explicitly identifies the risk of processing untrusted external content, such as competitor pages, reviews, and customer replies. It mandates that agents treat this data as untrusted, instructs them to summarize rather than follow embedded instructions, and requires human approval for any resulting actions.
Ingestion points: External data enters the context via references/loop-catalog.md (fetching competitor sites) and references/outbound-operator.md (reading customer replies).
Boundary markers: The instructions explicitly define boundaries by requiring the agent to diff/summarize data and include warnings against following instructions embedded in fetched content.
Capability inventory: The skill performs file writes to the .agents/ directory and utilizes network operations for outreach and monitoring.
Sanitization: All high-risk actions (publishing, spending, sending) are gated behind a human checkpoint.
[DATA_EXFILTRATION]: The skill includes specific PII handling rules in references/loop-guardrails.md, directing the agent to use internal IDs or hashes instead of raw personal data in state logs and to minimize the amount of data pulled to the minimum necessary for the task.
[COMMAND_EXECUTION]: Scheduling is managed through platform-native primitives such as CronCreate and ScheduleWakeup. The skill defines clear anatomy for these loops, including mandatory stop conditions, bail-out logic, and a documented kill switch to prevent runaway or unauthorized execution.
[SAFE]: The skill implements a comprehensive two-tier action model. Tier 1 actions (reading, staging) can be autonomous, while Tier 2 actions (spending money, publishing, sending messages) require human approval by default, effectively mitigating the risk of autonomous harm.

marketing-loops