The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection because it ingests and processes untrusted data from external URLs.
Ingestion points: The Extract the portfolio step in SKILL.md fetches and parses external, third-party firm portfolio pages.
Boundary markers: The skill documentation lacks instructions for the agent to use delimiters or to ignore embedded instructions within the scraped website content.
Capability inventory: The skill has read access to sensitive data via Databricks (SQL/Data Warehouse) and CRM tables, and write/sharing access to Google Workspace (Docs/Sheets/Drive).
Sanitization: There is no description of filtering or validation mechanisms to sanitize content retrieved from external websites before it is processed by the agent.
[EXTERNAL_DOWNLOADS]: The skill performs network operations to fetch data from external, non-whitelisted domains (the VC/PE portfolio websites). While essential for the skill's function, this creates an entry point for untrusted data.
[DATA_EXFILTRATION]: The skill manages a chain of access involving high-value internal data (ARR, CRM deals) and external-facing outputs. Although it includes a 'demo-safe' mechanism, an attacker could exploit the indirect injection surface to trick the agent into including financial details in the partner-facing document or creating external sharing links for the internal data sheet.

vc-portfolio-research