The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests contact metadata (emails, names, delivery stats) from the HubSpot Search API. While this data is used for reporting and local audit logging rather than prompt interpolation, it represents a surface where untrusted data from an external API enters the agent's environment.
Ingestion points: scripts/before.py (HubSpot Search API results) and scripts/after.py (local audit CSVs and HubSpot API).
Boundary markers: None. The data is processed as raw strings for CSV generation and terminal output.
Capability inventory: Network communication with api.hubapi.com and file system writes to the data/ directory.
Sanitization: None. The skill relies on the structured nature of the HubSpot API response.
[COMMAND_EXECUTION]: The skill utilizes the uv package manager to execute local Python scripts (scripts/before.py and scripts/after.py) for contact discovery and post-suppression verification. This is the primary intended function of the skill.
[SAFE]: The skill communicates with HubSpot, a well-known and trusted service, using standard API patterns. It correctly manages sensitive credentials by instructing the user to store them in a .env file rather than hardcoding them. Additionally, the most sensitive operation (changing marketing status) is restricted to a manual user action in the HubSpot UI, providing a robust safety boundary.

suppress-ghost-contacts