The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external data which creates a surface for indirect prompt injection attacks. \n- Ingestion points: External signals are ingested in Phase 4 (exit codes, logs, screenshots) and Phase 3 (evidence returned from delegated workers). \n- Boundary markers: Phase 1 requires freezing the scope and criteria, including explicit 'must NOT' constraints designed to block reward hacking and unauthorized behavior. \n- Capability inventory: The skill manages worker delegation, performs shell command execution via the 'verify:' property, and writes to the local file system using Durable Ledger Mode. \n- Sanitization: Validation is performed via an independent evaluator role and a specific rubric to reconcile evidence against criteria, though there is no mention of character-level escaping for command outputs. \n- [COMMAND_EXECUTION]: The skill instructs the agent to run arbitrary shell commands defined in the 'verify:' field of acceptance criteria. While this is necessary for its purpose of goal verification, it is a powerful capability that could be misused if malicious instructions are embedded in the criteria agreement phase. \n- [PRIVILEGE_ESCALATION]: The skill includes an 'Autonomy Mode' (超自律) which allows the agent to skip human-in-the-loop (HITL) confirmation for irreversible destructive operations like file deletions or schema changes, provided the scope was agreed upon in Phase 1. This represents a significant increase in the agent's effective authority.

goal-loop