The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The Python script scripts/openwa.py contains a hardcoded default API key (dev-admin-key) used for authentication against the OpenWA gateway. While presented as a default for development, this could lead to insecure configurations if not explicitly overridden in production environments.
[COMMAND_EXECUTION]: The skill relies on the agent executing a local Python script (scripts/openwa.py) with various command-line arguments. This execution pattern allows the agent to interact with the host system and network, with arguments potentially influenced by user instructions or external data.
[DATA_EXFILTRATION]: The skill provides the ability to read local files and upload them to a remote server (the WhatsApp gateway) via the --file and @file.json arguments. If an agent is compromised via prompt injection, this functionality could be abused to exfiltrate sensitive local data.
[PROMPT_INJECTION]: The skill retrieves and processes untrusted content from incoming WhatsApp messages, creating a surface for indirect prompt injection attacks.
Ingestion points: WhatsApp message bodies are fetched from the API and presented to the agent via the messages list and messages get commands.
Boundary markers: There are no explicit delimiters or instructions within the skill to help the agent distinguish between message data and its own core instructions.
Capability inventory: The agent has access to a script capable of performing network requests, reading local files, and sending messages to external recipients.
Sanitization: The retrieved message content is not sanitized or filtered before being added to the agent's context.

openwa