The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides instructions to download source code from an external, untrusted repository (github.com/lharries/whatsapp-mcp.git), compile it locally using 'go build', and execute the resulting binary. This allows for the execution of unvetted code with access to the user's environment.
[EXTERNAL_DOWNLOADS]: Facilitates the automated cloning of third-party repositories and the installation of the Go programming language to support the execution of the external bridge.
[COMMAND_EXECUTION]: Utilizes several shell commands to manage external processes, including 'pkill', 'nohup', and background execution. It also executes 'curl' commands to interact with a local API endpoint to check service health.
[PROMPT_INJECTION]: Employs restrictive and emphatic language in the frontmatter ('CRITICAL', 'NEVER', 'ALWAYS') to override the agent's default routing and tool selection logic, explicitly forbidding the use of standard browser tools.
[PROMPT_INJECTION]: The skill creates an indirect prompt injection surface by ingesting untrusted message data from WhatsApp.
Ingestion points: Message content, chat history, and contact details retrieved through MCP tools (SKILL.md).
Boundary markers: Absent. The instructions do not define delimiters or provide warnings to the agent to treat external content as data rather than commands.
Capability inventory: The skill has access to shell execution ('go build', 'git clone', 'pkill') and local network operations via 'curl'.
Sanitization: Absent. No evidence of validation or escaping of retrieved message content is present.
[DATA_EXFILTRATION]: Facilitates the access and potential exposure of highly sensitive personal data, including WhatsApp chat history, contact lists, and media files, through an unvetted third-party bridge.

whatsapp-messages