The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted customer messages from WhatsApp and ClaudeClaw conversations to infer communication styles.
Ingestion points: In scripts/profile.ts, the mineMessages function retrieves raw text from the group_messages and claudeclaw_turns database tables.
Boundary markers: The callClaude function uses simple text delimiters (--- conversation log --- and --- end log ---) to wrap the untrusted data, which can be bypassed by an adversary using similar formatting in a chat message.
Capability inventory: The skill updates the brand_ops and tenant_communication_prefs tables in the PostgreSQL database with the output from the LLM.
Sanitization: While the scripts use parameterized SQL queries to prevent SQL injection, they do not sanitize or validate the content of the conversation logs before sending them to the LLM, nor do they validate the resulting LLM output beyond basic JSON parsing.

tenant-tone-profiler