The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill fetches company names and domains from the HubSpot API, which are external data sources. This creates a theoretical surface for indirect prompt injection if the resulting CSV data is later processed by an LLM without proper sanitization or boundary markers.\n
Ingestion points: Company properties are retrieved from the HubSpot CRM API in scripts/before.py.\n
Boundary markers: The data is stored in structured CSV format, but the skill does not implement specific delimiters for the individual text fields to prevent instruction following by an LLM.\n
Capability inventory: The skill performs network GET requests to HubSpot and writes files to the local data/audit-logs/ directory.\n
Sanitization: Data is normalized for grouping (stripped and lowercased), but no filtering for malicious instructions is performed.\n- [EXTERNAL_DOWNLOADS]: The script scripts/before.py specifies dependencies that are resolved and downloaded at runtime using the uv package manager.\n
Dependencies: requests>=2.31 and python-dotenv>=1.0.\n
Context: These are well-known, standard libraries from the Python Package Index.\n- [COMMAND_EXECUTION]: The skill requires the user to execute a local Python script to perform the duplicate discovery logic.\n
Evidence: The SKILL.md instructions include running uv run skills/merge-duplicate-companies/scripts/before.py.

merge-duplicate-companies