The Agent Skills Directory

[PROMPT_INJECTION]: The script scripts/instantly_autoreply.py contains an indirect prompt injection vulnerability where user-controlled email content is interpolated into a system prompt for Claude.
Ingestion points: Untrusted data is retrieved from payload.get('reply_text') or payload.get('reply_html') representing incoming email threads.
Boundary markers: There are no delimiters or 'ignore' instructions surrounding the external email content in the prompt template.
Capability inventory: The script has the capability to read sensitive business data from Google Sheets via lookup_knowledge_base and send outbound communications via the Instantly API in send_reply.
Sanitization: No sanitization or escaping is performed on the incoming email text before it is processed by the AI model.- [DATA_EXFILTRATION]: The skill performs network operations to api.instantly.ai, which is an external domain. Additionally, while the script uses environment variables for API keys, the SKILL.md file indicates that the knowledge base spreadsheet contains 'credentials'. Because this data is fed into the LLM prompt, a successful prompt injection attack could be used to exfiltrate this sensitive information through automated email replies.

instantly-autoreply