The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the Ai好记 note-taking service which could potentially contain malicious instructions designed to influence the agent's behavior.
Ingestion points: Data enters the agent context through the note list and detail endpoints (GET /agent-open/api/v1/notes and GET /agent-open/api/v1/notes/{note_id}) as described in SKILL.md and the reference documentation.
Boundary markers: The skill instructions emphasize showing a "change plan" and waiting for explicit user confirmation before performing any write operations. However, the instructions do not specify the use of clear delimiters or "ignore embedded instructions" wrappers when processing external note content for summarization or classification.
Capability inventory: The skill is capable of creating, moving, and deleting notes and folders via the Ai好记 API. It does not possess arbitrary command execution, file system access outside of its own configuration, or general network capabilities.
Sanitization: The documentation in references/agent-open-platform.md states that markdown content is converted to "safe HTML" by the server-side API, which provides protection against traditional web-based injection, although LLM-specific prompt injection remains a potential surface.

aihaoji