The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides a command to install the Vapi CLI by downloading a script from https://vapi.ai/install.sh and piping it directly to bash. This is a vendor-controlled installer script provided for local development workflows.
[REMOTE_CODE_EXECUTION]: The skill documentation includes an instruction to add an MCP (Model Context Protocol) server using npx with the endpoint https://docs.vapi.ai/_mcp/server. This allows the agent to execute remote functionality provided by the vendor to access documentation.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data via webhooks, including call transcripts (message.transcript) and tool call results (message.toolCallList). Since this data is generated by external callers, it presents a surface for indirect prompt injection where malicious instructions could be embedded in the transcript to influence the agent.
Ingestion points: Webhook request body (SKILL.md).
Boundary markers: None present in the provided Express.js or Python code snippets.
Capability inventory: The skill uses curl for API requests and the Vapi CLI for local forwarding.
Sanitization: No evidence of data sanitization, schema validation, or instruction filtering is present in the server logic examples.
[COMMAND_EXECUTION]: The skill demonstrates the use of curl, ngrok, and the vapi CLI to configure webhooks, update assistant settings, and manage local development tunnels.

setup-webhook