The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill instructions specify the execution of a local JavaScript file scripts/sync-annotation-directory.mjs if it exists within the prototype directory. This allows the execution of arbitrary code provided within the project's directory structure.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill accesses sensitive project files including requirement specifications, metadata JSON files, and business logic definitions. While these are used to generate documentation for external platforms (Axhub and Yunxiao), it constitutes significant access to the project's internal data.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from local specification files and user descriptions to generate PRDs that are pushed to enterprise collaboration tools. This creates an attack surface for indirect prompt injection.
Ingestion points: Reads from src/prototypes/<id>/.spec/, lines.ts, and user-provided descriptions.
Boundary markers: The skill uses structured Markdown templates with defined headers to separate sections, which serves as a basic boundary but does not prevent adversarial injection.
Capability inventory: The agent can write files to the local filesystem (.md, .json) and execute local .mjs scripts via shell commands.
Sanitization: No explicit sanitization or validation of input data is mentioned in the provided instructions.

oneos-autoprd