The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes data from untrusted external sources (WhatsApp messages), creating a surface for indirect prompt injection attacks.
Ingestion points: Incoming messages received via the MESSAGES_UPSERT webhook event as documented in references/events.md.
Boundary markers: The documentation does not specify the use of delimiters or explicit instructions to ignore embedded commands within message content.
Capability inventory: The skill has broad capabilities including sending messages (/message/sendText), managing groups (/group/create), and triggering AI integrations (OpenAI, Dify) as listed in SKILL.md.
Sanitization: No sanitization or validation procedures for the message payload are mentioned before the data is processed by the agent.
[CREDENTIALS_UNSAFE]: The skill documentation describes the use and configuration of sensitive credentials and environment variables.
Evidence: references/environment-variables.md lists several sensitive configuration parameters including DATABASE_CONNECTION_URI (which may contain database credentials), SQS_SECRET_ACCESS_KEY, and S3_SECRET_KEY.
Note: While the provided values are generic placeholders for documentation purposes, they indicate that the agent will be required to manage and potentially expose highly sensitive authentication data.

evolution-api