The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The documentation for integrating external calendars instructs the AI to collect sensitive user credentials in plain text. Specifically, in references/bookings/external-calendar-integration.md, the instructions for connecting Apple Calendar via credentials require the agent to ask the user for their Apple ID email and password, which poses a security risk if these are stored in conversational history or logs.
[PROMPT_INJECTION]: The skill contains several instances of imperative language designed to override the agent's default operational logic and bypass user clarification steps.
Evidence: In references/ecommerce/recommend-ecommerce-strategy.md, the AI is told to "Do NOT ask clarifying questions" and to "execute every step in order" without producing recommendations before calling specific APIs.
Evidence: In references/stores/create-product-from-image.md, the AI is instructed to use a specific text description as the "only source of truth" and is prohibited from re-analyzing images later.
[PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection by processing untrusted user data and using it as parameters for administrative API calls.
Ingestion points: User-supplied images in references/stores/create-product-from-image.md and user-provided blog content in references/blog/how-to-create-blog-posts.md.
Boundary markers: Absent. The agent is directed to derive facts from these inputs without delimiters or warnings to ignore potential embedded instructions.
Capability inventory: The skill uses CallWixSiteAPI to perform high-privilege actions including product creation, site property modification, and metadata management.
Sanitization: There is no evidence of sanitization or validation of the content extracted from user inputs before its inclusion in API payloads.
[EXTERNAL_DOWNLOADS]: Multiple recipes include references to external images from well-known providers for use in product catalogs and blog posts.
Evidence: references/stores/bulk-create-products-with-options.md and references/media/upload-media-to-wix.md use URLs from images.unsplash.com.

wix-manage