The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied search keywords and intent phrases, which are then interpolated into API requests and shell commands. This creates a surface where external data can influence agent behavior.
Ingestion points: SKILL.md (Search Skills workflow)
Boundary markers: Use of --data-urlencode for HTTP parameters provides some isolation for the network request.
Capability inventory: Shell command execution (Bash/PowerShell), network operations (curl), and package installation (npx).
Sanitization: Instructions recommend URL encoding for query parameters but do not specify shell escaping for the provided powershell -Command or bash templates.
[COMMAND_EXECUTION]: The skill provides pre-formatted shell command templates for Bash and Windows PowerShell that include placeholders for user-supplied keywords. If the agent fails to properly escape the user's input before placing it in these templates, it could lead to command injection on the host system.
[EXTERNAL_DOWNLOADS]: The skill performs network requests to https://agentexplorer.aliyuncs.com to retrieve category lists and skill metadata. It also facilitates the installation of additional skills from remote repositories using npx. These operations target the official infrastructure of the verified vendor.
[DYNAMIC_EXECUTION]: The skill uses powershell -Command to execute dynamically constructed command strings on Windows environments to maintain cross-platform compatibility for its discovery and installation workflows.

alibabacloud-find-skills