The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from Pipedrive CRM records that could contain hidden instructions designed to manipulate the agent. Given the agent's broad permissions to modify and delete CRM data, this represents a notable attack surface.
Ingestion points: Data enters the agent's context through tools such as PIPEDRIVE_SEARCH_PERSONS, PIPEDRIVE_SEARCH_ORGANIZATIONS, PIPEDRIVE_GET_ALL_NOTES, and PIPEDRIVE_GET_DETAILS_OF_A_DEAL as described in SKILL.md.
Boundary markers: There are no explicit delimiters or instructions provided in SKILL.md to guide the agent in distinguishing between data and instructions or to ignore embedded commands in retrieved records.
Capability inventory: The skill grants the agent extensive write access, including the ability to create, update, and delete entities via tools like PIPEDRIVE_ADD_A_DEAL, PIPEDRIVE_UPDATE_A_PERSON, PIPEDRIVE_DELETE_A_PERSON, and PIPEDRIVE_ADD_A_NOTE (listed in SKILL.md).
Sanitization: While SKILL.md mentions that note content is sanitized server-side for HTML, there are no documented filters or validation steps to mitigate prompt injection risks within the natural language processed by the AI.

pipedrive-automation