The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from multiple external sources, creating a significant attack surface for indirect prompt injection where malicious instructions embedded in external content could influence the agent's behavior.
Ingestion points: The skill reads data from external news sites, social media platforms (X, Reddit, Hacker News), third-party review sites (G2, Capterra), and customer feedback channels (surveys, support tickets) as described in references/loop-catalog.md.
Boundary markers: There are no explicit prompt-level delimiters or instructions provided to the agent to treat this external content as untrusted data rather than instructions.
Capability inventory: The skill orchestrates powerful tools including social (for posting), emails (for sending messages), ads (for budget management), and revops (for revenue operations), all of which could be target actions for an injection attack.
Sanitization: The skill relies on a 'two-tier action model' defined in references/loop-guardrails.md which mandates human review for all 'Tier 2' actions (spend, send, publish). While effective for preventing immediate harm, the agent's internal analysis and drafting (Tier 1) remain susceptible to influence.
[COMMAND_EXECUTION]: The skill utilizes platform-specific commands to establish persistence and recurring execution.
Evidence: SKILL.md instructs the agent to use scheduling primitives such as CronCreate and ScheduleWakeup to automate loops. While these are legitimate platform features for the skill's stated purpose, they represent a mechanism for persistent execution on the host environment.

marketing-loops