The Agent Skills Directory

[SAFE]: The skill follows security best practices for handling sensitive information. It includes a dedicated security library (scripts/lib/security.js) that automatically redacts API keys, secrets, and tokens from output logs and conversational responses.
[SAFE]: Data exfiltration is mitigated through a URL validation mechanism (validateApiUrl) that ensures all API requests are directed to the authorized Kapso API origin, preventing the redirection of sensitive data to untrusted third-party hosts.
[SAFE]: The skill implements a secure method for handling one-time secrets using the KAPSO_SECRET_OUTPUT_FILE environment variable, which creates files with restricted permissions (owner-only access) and prevents overwriting existing files or following symbolic links.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from WhatsApp messages and webhook payloads. However, it includes explicit instructions in SKILL.md for the agent to treat all such data as information rather than instructions, significantly reducing the risk of indirect prompt injection attacks.
[EXTERNAL_DOWNLOADS]: The skill fetches OpenAPI specifications from the vendor's official documentation domain (docs.kapso.ai). This is a standard operational procedure for synchronizing with the platform's API capabilities and uses a trusted vendor source.

integrate-whatsapp