The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes untrusted inbound messages from social media platforms and includes them in the LLM generation prompt. \n
Ingestion points: Inbound DMs are fetched via the Late API in scripts/dm-response-agent.js (line 198) and queried from the database in scripts/facebook-inbox-agent.js (line 219). \n
Boundary markers: Untrusted input is wrapped in simple double quotes within the prompt strings (e.g., \"${messageText}\"), which does not reliably prevent an attacker from escaping the context and injecting instructions. \n
Capability inventory: The agent can read and send messages across Instagram, Twitter, LinkedIn, YouTube, and Facebook, and has read/write access to a PostgreSQL message tracking table. \n
Sanitization: No sanitization, filtering, or instruction-aware delimiters are used for the incoming message text. \n- [EXTERNAL_DOWNLOADS]: The skill connects to external services to perform its core functions. \n
Communicates with the Late API at zernio.com to manage social media conversations. \n
Interfaces with the Google Gemini API at generativelanguage.googleapis.com for content generation. \n- [CREDENTIALS_UNSAFE]: The database client configuration in scripts/facebook-inbox-agent.js disables SSL certificate validation. \n
Evidence: The Client initialization (line 213) uses ssl: { rejectUnauthorized: false }. This setting makes the connection vulnerable to man-in-the-middle attacks, potentially exposing sensitive database credentials or message content.

social-inbox-agent