The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from sales leads, such as Salesforce fields and email bodies, without sufficient boundaries or sanitization.
Ingestion points: Lead context and messages are ingested in the first step of the core workflow in SKILL.md.
Boundary markers: The skill does not use explicit boundary markers or instructions to disregard potential commands embedded within the lead data.
Capability inventory: The skill uses vitally:search_users and vitally:get_account_full to retrieve sensitive customer data (including MRR and health scores) and uses web_search and web_fetch for external connectivity.
Sanitization: No sanitization or filtering of the lead-provided text is performed before it influences the agent's logic or is used in email drafting.
Risk: A malicious lead could contain instructions designed to trick the agent into qualifying a lead, disclosing sensitive Vitally data, or exfiltrating information via the automated URL validation step (Step 5 in SKILL.md) that fetches all links in the generated draft email.

posthog-inbound-leads