The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill aggregates message data from untrusted external sources (WhatsApp, Instagram, Messenger, and Email), which creates a potential surface for indirect prompt injection if the agent processes malicious instructions embedded in customer inquiries.
Ingestion points: The scripts/ingest_inquiries.mjs script imports message text from external payloads into the messages and inquiries Busabase Bases.
Boundary markers: Absent; message text from inquiries is interpolated into the agent context via structured JSON fields without explicit markdown delimiters.
Capability inventory: The scripts/send_approved.mjs script performs network operations (POST requests) to Meta's Graph API and interacts with the kelly-email skill to send communications.
Sanitization: Absent; there is no explicit filtering or sanitization of the incoming message content before it is processed by the agent.
Mitigation: The risk is effectively mitigated by the skill's core architecture, which forces all outbound messages into an approval queue (approvals Base). Outgoing text is never sent autonomously; a human operator must review and Approve the draft in the AirApp UI, preventing the agent from being manipulated into performing unauthorized actions.

kelly-inquiry