The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external WeChat messages, which creates a surface for indirect prompt injection attacks.
Ingestion points: Messages are retrieved in SKILL.md using self.wechat.GetAllMessage() (Windows) and extractMessages(from:) (macOS).
Boundary markers: The provided code does not implement delimiters or specific instructions to the agent to ignore embedded commands within the message content.
Capability inventory: The skill has the capability to write back to the UI via self.wechat.SendMsg(content) and AXUIElementSetAttributeValue in SKILL.md.
Sanitization: While a sanitize_message_for_logging function is provided, it only truncates text for logs and does not sanitize content before it is processed by the agent.
[EXTERNAL_DOWNLOADS]: The skill instructions include the installation of the third-party Python package wxauto==4.0.0 from PyPI to facilitate Windows automation.
[COMMAND_EXECUTION]: The skill implementation involves UI automation and control of the WeChat application, including reading message history and programmatically interacting with input fields.
[PRIVILEGE_ESCALATION]: The macOS implementation in SKILL.md explicitly requests Accessibility permissions using AXIsProcessTrustedWithOptions, which is a requirement for UI automation on that platform.

wechat-automation