The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external complaint channels which creates a surface for indirect prompt injection attacks.
Ingestion points: The script scripts/ingest_intake.mjs reads and parses user-supplied intake files (e.g., WeChat exports, call logs, mailbox dumps) into the Busabase backend.
Boundary markers: The skill's instructions in SKILL.md do not define explicit delimiters or security boundaries for the agent when processing raw complaint text, nor do they instruct the agent to ignore potentially malicious instructions embedded within the intake items.
Capability inventory: The agent performs classification and triage on this data using scripts/apply_triage.mjs, which mutates the Busabase state. Furthermore, the agent is instructed to perform real-world crew notifications and resident replies via external skills (messenger/email/WeChat) based on these processed items.
Sanitization: The skill performs contact masking using the maskContact function in scripts/ingest_intake.mjs to protect PII by redacting long runs of digits, but it does not sanitize or filter the content of the complaint text processed by the LLM.

kelly-tickets