The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes untrusted data from an external platform (Open WebUI) which could contain malicious instructions designed to influence the agent's behavior.
Ingestion points: Fetches message content via list_channel_messages and extracted file text via get_file_content in scripts/client.py.
Boundary markers: None. External content is returned as raw strings and integrated into the agent context.
Capability inventory: The skill can perform authenticated network API calls and execute local CLI commands.
Sanitization: While the skill redacts sensitive API keys, it does not sanitize or filter the content of messages or files retrieved from the API.
[DATA_EXFILTRATION]: The helper script scripts/client.py includes a utility function _json_file_or_text used by multiple commands. This function checks if a string argument is a file path on the local system and, if it exists, reads its content. This could be abused to read sensitive local files if the agent is tricked into passing a system path as an argument for a JSON payload.
[COMMAND_EXECUTION]: The script scripts/client.py utilizes __import__ to dynamically load the standard json library. While this is used for standard data serialization, dynamic imports are generally monitored as they can be used to bypass static analysis in more complex attack scenarios.

open-webui-skill