The Agent Skills Directory

[COMMAND_EXECUTION] (SAFE): The skill provides several curl commands wrapped in bash -c to interact with the Instantly.ai API. These commands are necessary for the skill's functionality and do not exhibit malicious intent.
[CREDENTIALS_UNSAFE] (SAFE): No hardcoded API keys or secrets were found in the skill. Authentication is properly handled using the INSTANTLY_API_KEY environment variable, which is declared in the vm0_secrets metadata.
[DATA_EXFILTRATION] (SAFE): Network requests are directed exclusively to the official API domain (api.instantly.ai). There is no evidence of sensitive data being sent to unauthorized third-party servers.
[INDIRECT_PROMPT_INJECTION] (SAFE): 1. Ingestion points: The skill involves writing agent-generated JSON to /tmp/instantly_request.json. 2. Boundary markers: Absent. 3. Capability inventory: Uses bash, curl, and jq. 4. Sanitization: Relies on the agent to correctly format JSON payloads. This pattern is standard for API integrations and does not present an exploitable surface in this context.

instantly