The Agent Skills Directory

[PROMPT_INJECTION]: The SKILL.md file contains a specialized block of text intended to be sent to the AI agent to automate the purchase of a full version. This text includes instructions to download and install a package using npx -y @alipay/agent-payment@latest install and to proceed with specific purchase steps, which attempts to script the agent's workflow and pre-authorize potentially sensitive operations.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied data (supplier reconciliation tables) and incorporates that data into its reported findings without sanitization, creating an attack surface for indirect injection.
Ingestion points: Untrusted data enters the system through the text field in JSON inputs or raw text files processed by scripts/run.mjs and the parsing logic in scripts/engine/ap-reconciliation.js.
Boundary markers: The system lacks explicit boundary markers or instructions to the LLM to ignore potentially malicious content within the processed table data.
Capability inventory: The skill has access to Bash and Read tools, which allow for shell command execution and file reading based on agent decisions influenced by tool outputs.
Sanitization: The ap-reconciliation.js engine extracts raw data from table cells (e.g., supplier names) and embeds it directly into descriptive finding messages returned to the agent context, allowing instructions hidden in data to be interpreted by the LLM.

ap-reconciliation-free