The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests and processes untrusted data from WhatsApp, including message text, contact names, and group metadata.
Ingestion points: Data enters the agent's context through search and list commands defined in references/messages.md and references/addressbook.md.
Boundary markers: The instructions do not mandate the use of strict delimiters or specific "ignore embedded instructions" warnings when the agent handles message content, increasing the risk that the agent might follow instructions contained within a received message.
Capability inventory: The skill possesses significant capabilities, such as sending messages (send text), deleting messages (messages delete), and downloading files (media download), which could be leveraged if an injection attack is successful.
Sanitization: There is no evidence of content sanitization or filtering to prevent the execution of embedded instructions.
[COMMAND_EXECUTION]: The skill's operational core relies on executing shell commands via the wacli CLI. Although the skill provides a strict classification of "read-only" vs "write" commands in references/safety.md, it grants the agent authority to manage sensitive communication data through local process execution.
[EXTERNAL_DOWNLOADS]: The skill references an external repository (github.com/openclaw/wacli) for the installation of the required CLI tool. While the documentation in references/install.md explicitly prohibits silent installation and directs the user to perform the setup manually, it introduces a dependency on third-party software from a non-standard source.

whatsapp