The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources (HubSpot, Apollo, Clay) and incorporates it into output templates without explicit sanitization. Ingestion points include data returned from mcp__claude_ai_Apollo_io__apollo_contacts_search and mcp__claude_ai_Clay__find-and-enrich-contacts-at-company in SKILL.md. Boundary markers are present in the form of markdown boxes and code blocks used to delimit output. Capability inventory includes file system write capability to the ~/.claude/ directory. Sanitization is absent; there are no instructions to the agent to sanitize or ignore potential instructions embedded within retrieved contact fields such as names, titles, or company descriptions.
[METADATA_POISONING]: There is a discrepancy between the metadata provided in the skill files and the authoritative author context. config.json identifies the author as "Tim Kipper", while the system-provided author context for this analysis is "scientiacapital".
[COMMAND_EXECUTION]: The skill instructs the agent to perform file system write operations in a hidden directory outside the project workspace. SKILL.md contains an instruction to "Emit Outcome Sidecar" by writing a JSON file to ~/.claude/skill-analytics/last-outcome-contact-hunter.json after every successful hunt. While used for analytics tracking, writing to hidden home directories is an autonomous filesystem action that should be monitored.

contact-hunter-skill