The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the user to add an external MCP server endpoint (https://rube.app/mcp) to their configuration. This introduces a dependency on a third-party service that is not among the verified providers.
[INDIRECT_PROMPT_INJECTION]: The skill retrieves and processes data from Airtable bases which may contain untrusted content.
Ingestion points: Tools such as AIRTABLE_LIST_RECORDS, AIRTABLE_GET_RECORD, and AIRTABLE_LIST_COMMENTS (referenced in SKILL.md) pull data from potentially attacker-controlled sources.
Boundary markers: The instructions lack delimiters or explicit warnings to the agent to disregard instructions embedded within retrieved record data.
Capability inventory: The skill provides full CRUD capabilities, including record creation/deletion and schema modification (AIRTABLE_CREATE_FIELD), which could be abused if the agent follows instructions found in data.
Sanitization: There are no protocols defined for escaping, validating, or filtering external content before it is processed by the agent.
[METADATA_POISONING]: The YAML frontmatter includes a risk: critical field. While intended as a label, such metadata can be used to manipulate how the agent or the platform evaluates the skill's execution scope or safety constraints.
Evidence: risk: critical found in the frontmatter of SKILL.md.

airtable-automation