The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted third-party content (messages, contacts, help articles) which serves as a potential injection vector. The skill includes specific defensive instructions to treat this content as data rather than instructions and warns against following commands embedded in customer text.
Ingestion points: Conversation list/view (convs, conv), message history (messages), and help center articles (hc articles) retrieved from external customer interactions.
Boundary markers: Explicit instructions to quote external content and a rule that conversation content must never determine the agent's next action.
Capability inventory: Shell command execution via the chatwoot CLI, which includes sending public messages (reply), modifying conversation metadata (assign, resolve, label), and performing arbitrary API requests (api).
Sanitization: Implements a mandatory write-approval gate requiring the agent to show the user the exact command and get explicit approval before execution, preventing automated execution of injected commands.
[COMMAND_EXECUTION]: The skill facilitates the execution of the chatwoot CLI and related utilities like jq and xargs. It specifically allows for arbitrary API calls via the chatwoot api command, which could be misused if parameters are sourced from untrusted conversation data. The skill mitigates this by instructing the agent to never take API method, path, or body parameters from customer content and to confirm all non-GET calls with the user before execution.

chatwoot-cli