The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides a setup command curl -fsSL https://chwt.app/install-cli | sh in both SKILL.md and references/cli.md. This pattern downloads a script from a remote server and executes it directly in the shell, which allows for the execution of arbitrary, unverified code on the host machine.
[EXTERNAL_DOWNLOADS]: The CLI installation process relies on fetching resources from https://chwt.app/install-cli, a domain that is not recognized as a trusted official source for Chatwoot software, increasing the risk of supply chain attacks.
[COMMAND_EXECUTION]: The skill makes extensive use of the chatwoot CLI to perform operations such as listing conversations, replying to messages, and managing account configurations. These operations involve executing numerous shell commands which could be exploited if user-controlled input is not handled correctly.
[PROMPT_INJECTION]: The skill has a clear surface for indirect prompt injection when processing customer conversation data for feedback summaries.
Ingestion points: chatwoot convs and chatwoot api /conversations (SKILL.md).
Boundary markers: Absent. The instructions do not define delimiters or specific warnings to ignore instructions embedded within the fetched conversation content.
Capability inventory: The skill has extensive shell command execution capabilities via the chatwoot CLI (SKILL.md, references/cli.md).
Sanitization: Absent. No measures are described to sanitize, escape, or validate the content of incoming messages before they are processed by the agent.

chatwoot