The Agent Skills Directory

[PROMPT_INJECTION]: The skill utilizes swan-update-skill to dynamically overwrite its own SKILL.md file with configuration data such as CRM mappings and SLAs. This self-modification mechanism allows for persisted state but introduces a vector where malicious data in CRM fields could influence future agent instructions.
[COMMAND_EXECUTION]: For large result sets, the agent is instructed to use swan-execute-code to aggregate data from disk. This involves the generation and execution of code at runtime to process data retrieved from the external HubSpot CRM.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection by processing untrusted data from HubSpot (deals, engagements) and business event APIs. * Ingestion points: Data enters the agent context through hubspot-search-objects, hubspot-get-engagements, and swan-fetch-business-events. * Boundary markers: There are no explicit delimiters or instructions to treat external data as untrusted content. * Capability inventory: The skill can modify its own code/instructions, execute arbitrary code via the sandbox, and create tasks or notes in the CRM. * Sanitization: No sanitization or validation logic is defined for the external data before it is used for flagging anomalies or updating instructions.
[DATA_EXFILTRATION]: The skill accesses and processes sensitive organizational data, including deal values, contact details, and engagement history. While necessary for the skill's function, it represents a high-privilege data access surface.

pipeline-review