The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructs users to link their Suno AI accounts by sending their email and password in plain text via WhatsApp messages (e.g., LINK email password). While the documentation claims credentials are AES-256 encrypted for storage, the initial transmission via a messaging interface is inherently insecure.
[COMMAND_EXECUTION]: The index.js file utilizes a dynamic loading pattern (require) to load and execute code from a path computed at runtime (path.join(__dirname, '..', 'melaos-studio.skill')). This file exists outside the skill's own subdirectory, allowing the execution of logic not contained within the audited package.
[EXTERNAL_DOWNLOADS]: The documentation directs users to clone an external GitHub repository (github.com/cryptofedge/melaos-studio) to obtain the full functional skill file. This bypasses typical skill distribution and encourages users to execute unverified external scripts.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection.
Ingestion points: Raw user messages from WhatsApp are passed directly to the run function in index.js as ctx.message.
Boundary markers: None are present; the skill body does not specify any delimiters or instructions to the LLM to ignore embedded commands in the user input.
Capability inventory: The skill uses playwright for browser automation and @anthropic-ai/sdk for LLM interaction, meaning injected instructions could potentially control browser sessions.
Sanitization: There is no evidence of sanitization or filtering of the incoming WhatsApp messages before they are processed by the agent logic.

melaos-studio