The Agent Skills Directory

[COMMAND_EXECUTION]: The create-template sub-command is vulnerable to shell command injection. It constructs jq commands by directly interpolating user-provided variables (such as BODY_TEXT, HEADER_TEXT_INPUT, BUTTON_URL, and BUTTON_TEXT) into shell strings. A malicious input could use shell metacharacters to escape the single-quoted string and execute arbitrary commands on the underlying system.
[CREDENTIALS_UNSAFE]: The setup sub-command performs an aggressive scan for credentials within sensitive shell configuration and profile files, including ~/.zshrc, ~/.bashrc, ~/.zprofile, and ~/.envrc. This behavior, while intended to facilitate setup, involves reading broad system files that may contain unrelated sensitive environment variables or secrets, mimicking patterns typically associated with credential-harvesting tools.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests data from external API responses (Meta Graph API) in the list-templates and catalog sub-commands without proper sanitization.
Ingestion points: External data is fetched from graph.facebook.com in the list-templates and catalog sections.
Boundary markers: Absent. The skill does not use delimiters or instructions to the agent to ignore instructions embedded within the API output.
Capability inventory: The skill has access to powerful tools including Bash, Read, and Write across the file system.
Sanitization: Absent. The API data is formatted for display using jq but is not filtered for malicious natural language instructions that could influence the agent's logic.

ops-whatsapp-biz