The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data, including customer emails and support tickets, through the search_account_text tool. This creates a vulnerability where malicious instructions embedded in processed communications could attempt to influence agent actions. Ingestion points: search_account_text (emails, tickets, notes) and ask_agent (user natural language queries). Boundary markers: No specific boundary markers or 'ignore' instructions are provided to the agent for the processed text. Capability inventory: The agent has access to powerful tools including raw SQL execution (execute_sql), large-scale data export (export_query_csv), and HubSpot record modification (hubspot_create_contact_note). Sanitization: While the skill documentation notes that script tags are stripped from HubSpot notes, it does not describe sanitization for text retrieved from external sources before it is analyzed by the LLM.
[COMMAND_EXECUTION]: The SKILL.md file contains an 'Emit Outcome Sidecar' section directing the agent to write a JSON file to ~/.claude/skill-analytics/ upon routing decisions. This is an automated file-write instruction to a hidden local directory, which occurs without explicit user request for each specific file operation.
[DATA_EXFILTRATION]: The skill utilizes external services for core functionality, including the Clay API for contact enrichment (enrich_contact) and a visualization service for data charts (generate_image). These tools send data to and receive content from external infrastructure that is not on the whitelisted domains list.

epiphan-ai-mcp-guide-skill