The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest untrusted data from two primary sources: user-provided requirement descriptions and the contents of a local repository located at OPS_PROJECT_ROOT/catlass/.
Ingestion points: User input described in the '需求输入' section of SKILL.md, and the external file system content in the catlass/ directory (including include/, examples/, and docs/) as specified in the '阅读 catlass 并选型' section.
Boundary markers: The instructions do not define explicit delimiters or instructions for the agent to ignore embedded commands within the ingested data, which could allow instructions hidden in code comments or documentation within the target repository to influence the agent.
Capability inventory: The skill requires the agent to read files from the local filesystem and write the resulting design document to a path defined by USER_OP_PROJECT as a Markdown file.
Sanitization: There are no specified sanitization or validation steps for the content read from the external repository or user input. An attacker could potentially place malicious instructions in the repository files or requirement strings to influence the agent's output logic or document generation.

catlass-operator-design