The Agent Skills Directory

[DATA_EXFILTRATION]: The skill collects and stores lead data in a 'handoff event' log located at <repo-root>/.workspace/events/YYYY-MM.jsonl. While intended for inter-agent communication, these files contain potential PII (e.g., user_id, signup methods) stored in plain-text JSONL. Because the skill does not automatically add this directory to .gitignore (unlike its secrets management), there is a risk that sensitive lead data could be committed to version control or otherwise exposed.
[COMMAND_EXECUTION]: In its 'P3 — Autonomous-with-escalation' mode, the skill is granted the capability to autonomously post to social media channels and spend advertising budgets within configured caps. While this mode is gated behind a 'trust ramp' requiring prior human oversight, it represents a high-impact capability where a logic error or malicious input could result in financial loss or reputational damage.
[PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection (Category 8) due to its core functionality of ingesting external startup artifacts to drive content generation.
Ingestion points: The skill automatically detects and reads validation-canvas.md, DESIGN.md, and pitch-deck artifacts (deck.html) to extract ICPs, messaging, and brand voice (Phase 0.3).
Boundary markers: The prompt templates used for content generation (documented in references/marketing-fallback.md) interpolate data from these artifacts directly into instructions without the use of delimiters (e.g., XML tags) or specific 'ignore' instructions for embedded content.
Capability inventory: The skill possesses significant capabilities, including filesystem writes across the workspace and the ability to dispatch tasks to external plugins or MCPs for network operations (Discord, social platforms, analytics APIs).
Sanitization: There is no evidence of sanitization or validation performed on the content retrieved from the ingested artifacts before it is used to influence the agent's output.
[EXTERNAL_DOWNLOADS]: The skill integrates with multiple third-party metrics services including PostHog, Plausible, GA4, Mixpanel, and Amplitude. It manages these connections using API keys stored in a gitignored secrets.local.yaml file. While these are well-known services and the skill follows best practices for secret storage, the reliance on external metrics APIs constitutes a remote data dependency.

gtm