The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes untrusted user input from WhatsApp which creates a surface for indirect prompt injection attacks.\n
Ingestion points: Untrusted text is ingested through the messageBody parameter in the handleMessage method of the OnboardingModule interface (referenced in SKILL.md).\n
Boundary markers: The documentation does not specify the use of delimiters (such as XML tags or triple quotes) or specific instructions to the model to ignore embedded commands within the message body.\n
Capability inventory: The skill has the capability to update database tables (onboarding_module_state, onboarding_pipeline_state), invoke external generation APIs (Kie.ai), and manage complex state transitions through module-router.ts.\n
Sanitization: While intent-classifier.ts is mentioned for NLU classification, there is no evidence of sanitization or escaping of the user-provided messageBody to prevent the injection of malicious instructions.

worker-onboarding