The Agent Skills Directory

[PROMPT_INJECTION]: The skill ingests untrusted text from external channels such as WeChat group exports, phone call logs, front-desk forms, and email services via scripts/ingest_intake.mjs. This data is subsequently processed by the agent for classification and triage, creating a potential surface for indirect prompt injection.
Ingestion points: External data enters the system context through scripts/ingest_intake.mjs, which reads user-provided intake payloads.
Boundary markers: The skill's scripts do not implement explicit delimiters or delimiters instructing the model to ignore embedded commands when processing the verbatim complaint text.
Capability inventory: The skill possesses capabilities to write to Busabase databases (scripts/apply_triage.mjs) and generate draft crew notification plans (scripts/execute_decisions.mjs).
Sanitization: While the maskContact function protects PII by redacting phone numbers and handles, the skill does not sanitize the complaint text for embedded malicious instructions. However, the requirement for manual approval in the dispatch proposal queue serves as a significant human-in-the-loop mitigation against automated exploitation.

kelly-tickets