The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes untrusted external content from LinkedIn (comment text, post content) via the LINKEDIN_ENGAGEMENT trigger and swan-fetch-scraped-url. This content is handled without explicit boundary markers or sanitization, creating a surface for indirect prompt injection.
Ingestion points: Trigger payload (comment text, post summary), swan-fetch-scraped-url (post topic and angle).
Boundary markers: Absent; the agent is not instructed to isolate or ignore instructions embedded within the LinkedIn data.
Capability inventory: swan-update-skill (can modify agent instructions), hubspot-create-task (write to CRM), reach-out (outbound communication), swan-execute-code (file access).
Sanitization: None; external input is interpolated directly into response drafts.
[COMMAND_EXECUTION]: The skill instructions direct the agent to use swan-execute-code to read tool output files from the local filesystem (files/tool-outputs/<toolName>_<callId>.json). This involves dynamic execution and file system access.
[PROMPT_INJECTION]: The swan-update-skill tool is used to persistently modify the SKILL.md file's instructions (the 'Setup state' paragraph). While intended for configuration management, this self-modification capability could be abused to persistently alter agent behavior if the agent is successfully manipulated by external input.

post-radar