The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill contains a shell pattern (curl | python3) that fetches data from a remote URL and pipes it into a language interpreter. Although the example specifically uses the -m json.tool module for safe JSON formatting, the structural pattern of piping network-sourced data to an interpreter is a significant security risk if the command is misapplied or the module is omitted.
[EXTERNAL_DOWNLOADS]: The skill utilizes curl to perform network operations against external REST APIs (e.g., api.example.com) to retrieve JSON data for connector planning and configuration.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from untrusted external REST APIs, which creates a potential surface for indirect prompt injection attacks.
Ingestion points: External JSON responses fetched via curl during the inspection phase described in the workflow.
Boundary markers: There are no instructions for the agent to use delimiters or security markers when inspecting the raw output of external APIs.
Capability inventory: The agent has network access via curl and can modify the environment by creating data accounts and streams through the Domo Product API.
Sanitization: The skill lacks any instructions for the validation, escaping, or sanitization of content retrieved from external sources before it is analyzed by the agent.

json-no-code-connector