The Agent Skills Directory

[SAFE]: The skill utilizes official vendor-provided tools, including the Zapier Model Context Protocol (MCP) server at https://mcp.zapier.com and the Zapier SDK for workflow management.\n- [SAFE]: Instructions in README.md, SKILL.md, and SETUP.md consistently mandate human approval for any impactful actions, such as sending messages or updating records, which serves as a critical safety barrier.\n- [SAFE]: The setup instructions in SETUP.md and ONBOARDING-PROMPT.md follow security best practices by recommending sanitized test runs and starting with read-only tool configurations.\n- [PROMPT_INJECTION]: The skill processes untrusted external data (design briefs and brand guidelines), which presents an attack surface for indirect prompt injection. Evidence Chain: (1) Ingestion points: Design briefs and brand guidelines are read into the agent context as described in SKILL.md Workflow Step 1 and defined in SCHEMA-MAP.md; (2) Boundary markers: None explicitly defined in instructions; (3) Capability inventory: Uses Zapier MCP and SDK for reading brand docs and logging feedback; (4) Sanitization: The risk is mitigated by explicit human approval requirements in README.md and recommendations for sanitized test runs in SETUP.md.

brand-guidelines-builder