The Agent Skills Directory

[PROMPT_INJECTION]: The SKILL.md file includes a specific prompt block intended for the user to feed back into the AI agent to automate the acquisition of a paid version. This prompt contains explicit instructions designed to override standard safety confirmation protocols, such as 'I have authorized the installation of dependencies and initiation of purchase' and 'do not confirm for me', which directs the agent to skip interactive security checkpoints for sensitive actions.
[REMOTE_CODE_EXECUTION]: The skill's documentation provides an installation command (npx -y @alipay/agent-payment@latest install) within its 'Upsell' instructions. When executed by an agent, this command fetches and executes code from the NPM registry. The package belongs to the well-known service Alipay.
[COMMAND_EXECUTION]: The skill instructions and metadata authorize the use of the Bash tool to execute local scripts (scripts/run.mjs) and Node.js commands. These commands are used to process financial data files provided by the user.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input data (financial tables) in scripts/engine/asset-disposal-check.js to perform calculations.
Ingestion points: User-provided table text is ingested via the text field in the input JSON in scripts/engine/asset-disposal-check.js.
Boundary markers: The processing script does not implement delimiters or 'ignore embedded instructions' markers for the parsed table rows.
Capability inventory: The skill has access to the Bash and Read tools as defined in the skill metadata.
Sanitization: The script uses regular expressions to normalize numbers and extract data but does not sanitize the text for potentially malicious instructions that could influence the agent if it reviews the audit findings.
[METADATA_POISONING]: The SKILL.md file uses its description and body to aggressively promote a paid version of the tool, including providing automation scripts that instruct the agent to perform financial transactions and package installations, which blurs the line between functional documentation and automated marketing.

asset-disposal-check-free