The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The setup instructions require the user to add a remote endpoint (https://rube.app/mcp) as an MCP server. This directs the agent to load and execute tools from a third-party domain that is not affiliated with the skill author or a recognized major service provider, creating a dependency on an unverified external source.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it facilitates the ingestion of untrusted subscriber data while maintaining sensitive account capabilities.
Ingestion points: Untrusted subscriber information is retrieved into the agent's context using the KIT_LIST_SUBSCRIBERS tool (SKILL.md).
Boundary markers: The instructions do not define clear delimiters or provide the agent with warnings to ignore embedded instructions within subscriber profiles or email addresses.
Capability inventory: The agent has access to destructive tools such as KIT_DELETE_SUBSCRIBER and KIT_DELETE_BROADCAST (SKILL.md), which could be triggered by malicious instructions hidden in the data it processes.
Sanitization: There is no evidence of filtering, escaping, or validation of the subscriber data before it is interpolated into the agent's reasoning flow.

convertkit-automation