The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides numerous shell commands for interacting with the Domo API via the community-domo-cli and standard curl utilities for card CRUD (Create, Read, Update, Delete) operations. These instructions involve the use of sensitive environment variables like $TOKEN and $INSTANCE for authentication.
[DYNAMIC_EXECUTION]: Python scripts are utilized via heredocs and one-liners (e.g., python3 -c and python3 << 'PYEOF') in SKILL.md and references/examples.md to parse, transform, and update JSON card definitions. These scripts represent a dynamic execution surface for locally generated code templates.
[INDIRECT_PROMPT_INJECTION]: The skill implements a workflow that ingests data from external sources (the Domo API) which can be influenced by third-party content, creating a potential injection vector.
Ingestion points: references/examples.md describes a "Read → Modify → Update" pattern where the agent is instructed to fetch card definitions from Domo into local files (current.json) and then process them.
Boundary markers: Absent; the ingested JSON data is not wrapped in delimiters or provided with warnings to ignore embedded instructions before being processed by the agent or scripts.
Capability inventory: The skill possesses powerful capabilities to create, update, and delete cards across the Domo instance, which could be exploited if malicious instructions were successfully injected into a card's description or title fields.
Sanitization: Absent; while the provided Python scripts perform structural transformations (e.g., fixing format mismatches), they do not sanitize or validate the actual values/strings within the JSON definition against potential prompt injection attacks.

card-creation