The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill provides templates for building interactive Telegram bots, which inherently ingest untrusted user input.
Ingestion points: Untrusted data enters the application through onText, onCommand, and onDataCallbackQuery handlers in handlers/CommandHandlers.kt and handlers/MessageHandlers.kt.
Boundary markers: The architecture separates message content from execution logic using handlers and state machines (FSM), though it relies on the developer to properly escape or sanitize output.
Capability inventory: Bots built with these patterns can perform network requests via HttpClient, interact with the Telegram API, and execute business logic in UserService.kt.
Sanitization: The patterns include basic validation examples (e.g., checking email format with contains("@") and name length) and security-relevant utility functions like isAdmin to gate privileged operations.
[SAFE]: The skill correctly handles sensitive information by using System.getenv("BOT_TOKEN") and getProperty("API_KEY") instead of hardcoding secrets.
[SAFE]: Includes defensive patterns such as a RateLimiter to prevent abuse and a withErrorHandling wrapper to ensure the bot remains stable and provides user-friendly error messages.

ktgbotapi-patterns