The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from local WeChat message history and contact details, creating a surface for indirect prompt injection.
Ingestion points: untrusted data enters the context through scripts/wechat-safe.mjs and content/busa-wechat-crm-app/wechat-status.mjs which query message history, contact names, and remarks.
Boundary markers: The skill uses structured JSON formatting for all ingested data and provides explicit instructions in SKILL.md to use safe wrappers rather than piping raw output.
Capability inventory: The skill utilizes execFile to run local binaries and uses the busabase-sdk to write data to an external CRM folder.
Sanitization: The skill employs a specialized library (scripts/lib/sensitive-content.mjs) that uses regular expressions to detect and redact sensitive secrets, including OpenAI keys, AWS keys, and Bearer tokens, before they are returned to the agent.
[COMMAND_EXECUTION]: The skill executes the wechat-cli-rs command-line utility to interact with local data.
Execution is managed through execFile and execFileSync, which are safer than shell-spawning methods like exec.
Commands are strictly limited to an allowlist of read-only operations: contacts, sessions, history, search, stats, and unread.
The skill explicitly forbids automatic initialization (wechat-cli-rs init), requiring the user to run the command manually in their terminal.

busa-wechat-crm