The Agent Skills Directory

[SAFE]: The skill is authored by SallaApp and serves as a legitimate technical guide for platform integrations. It follows established best practices for secure application development within the Salla ecosystem.
[DATA_EXFILTRATION]: The skill's primary purpose involves transmitting customer notification data and provider credentials to external communication APIs (SMS/Email/WhatsApp). This is a functional requirement. The documentation provides clear security guidance to treat these endpoints as untrusted, recommending URL validation to prevent malicious redirection.
[PROMPT_INJECTION]: The skill handles notification content originating from store events, which constitutes an indirect prompt injection surface.
Ingestion points: context.payload.data.content in SKILL.md and references/communication-events.md.
Boundary markers: Absent in the simplified code examples, but the documentation specifies security rules for handling this data.
Capability inventory: Network operations via the fetch API in SKILL.md (Step 4).
Sanitization: The guide explicitly mandates redacting sensitive information from logs and validating external provider endpoints before use.
[CREDENTIALS_UNSAFE]: The skill correctly directs the use of context.settings for merchant-supplied API keys and secrets, ensuring that no credentials are hardcoded or stored inappropriately.

salla-communication-app