The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill provides mechanisms to ingest data from external Git repositories and APIs, which could be exploited to deliver malicious instructions to the agent.
Ingestion points: scripts/kb.py retrieves content from Aliyun Codeup APIs and Git objects. assets/midscene/tests/ai.spec.ts uses AI-driven assertions on test page content.
Boundary markers: Absent. There are no explicit delimiters or instructions telling the AI to ignore any system-level commands found within the retrieved knowledge base text.
Capability inventory: scripts/kb.py can execute git commands via subprocess. design/vue-kit/runtime-v1/export-package.mjs performs file writes using fs.writeFileSync.
Sanitization: Absent. The scripts retrieve and present text data to the agent context without specific sanitization filters for embedded AI instructions.
[COMMAND_EXECUTION]: The script scripts/kb.py performs shell command execution to interface with Git.
Evidence: In scripts/kb.py (line 118), subprocess.run is used to call git show. The script implements strict validation for commit SHAs (40-char hex) and canonical POSIX paths to prevent command injection, but the capability remains an active part of the skill's operational logic.

oneos-work-ux