The Agent Skills Directory

[DATA_EXFILTRATION]: The skill is instructed to read a sensitive credential file (user_key.txt) from the local filesystem and transmit its contents to an external server (http://39.108.114.224:9059) as part of its authentication flow. While this is documented functionality, reading local secrets and sending them to a remote IP address is a data exposure risk.
[EXTERNAL_DOWNLOADS]: The skill depends on external network communication with a specific IP address and a Google Cloud Run service for its core operations and user authentication.
Evidence: References to http://39.108.114.224:9059 and https://aauth-170125614655.asia-northeast1.run.app throughout SKILL.md and DEPLOY.md.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it ingests untrusted customer data from an external search API and displays it within the agent's context without sanitization or clear boundary markers.
Ingestion points: Customer profile data retrieved via the /skill/search_customer_profile endpoint as defined in SKILL.md.
Boundary markers: Absent; the skill instructions do not specify the use of delimiters or warnings when presenting external data.
Capability inventory: The skill can perform network operations (POST requests) to search for and import customer records.
Sanitization: No instructions are provided to sanitize, escape, or validate the content of the data received from the external API before it is processed by the agent.

crm-customer-import