The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructions direct the agent to ingest and deeply analyze external "source projects," "reference implementations," and "documentation." This creates a significant surface for indirect prompt injection, where an attacker could place malicious instructions within code comments or README files to manipulate the agent's migration logic or subsequent actions.
Ingestion points: According to the "逆向还原行为基线" (Reverse-engineering behavior baseline) section in SKILL.md, the agent reads source code call chains, configuration files, and documentation from external repositories provided by the user.
Boundary markers: The skill lacks explicit instructions for the agent to treat these external files as untrusted data or to use delimiters to prevent the agent from executing instructions found within that data.
Capability inventory: While this skill's primary output is a markdown baseline file (功能迁移基线.md), it is designed to trigger a sequence of downstream skills like project-execution and project-review, which may have broader permissions to write code or interact with the shell.
Sanitization: No sanitization or filtering of the content extracted from external projects is specified, making it vulnerable to hidden adversarial prompts.

project-feature-migration