The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted user data (direct messages) and interpolates it directly into the LLM prompt. An attacker could send a malicious DM designed to override the agent's instructions.
Ingestion points: Message content and sender names are fetched from the Late API in scripts/dm-response-agent.js (line 199) and scripts/facebook-inbox-agent.js (line 99).
Boundary markers: Minimal delimiters are used (simple double quotes and labels), which do not reliably prevent instruction override.
Capability inventory: The agent has the ability to send messages via the Late API and perform database write operations.
Sanitization: DM content is not escaped, filtered, or validated before being included in the prompt instructions.
[COMMAND_EXECUTION]: A SQL injection vulnerability exists in scripts/facebook-inbox-agent.js at line 258. The script interpolates the _persona.name variable directly into a SQL INSERT statement string instead of using parameterized queries. While the source for this variable is a local configuration file (onboarding-config.json), this practice is insecure and could be exploited if the configuration source is compromised.
[EXTERNAL_DOWNLOADS]: The skill makes legitimate network requests to the Gemini API (generativelanguage.googleapis.com) and the Late API (zernio.com) to generate responses and synchronize messages. These are core functions of the skill's stated purpose.
[CREDENTIALS_UNSAFE]: Both primary scripts access the .env file using a relative path from the script's directory to load API keys and database connection strings. While standard for local automation tasks, users should ensure the environment file has restrictive file permissions.

social-inbox-agent