The Agent Skills Directory

[PROMPT_INJECTION]: The SKILL.md file contains a pre-defined prompt template intended for users to send to their AI assistant. This template includes instructions that attempt to override the agent's standard operational behavior, specifically by claiming prior authorization for transactions ("我已授权安装依赖和发起购买") and explicitly instructing the agent to bypass confirmation steps ("不要替我确认").
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted document data (reimbursement forms and invoices) provided by the user. Portions of this raw text are included in the final report output in the evidence field. Malicious instructions embedded in the input documents could potentially influence the AI agent when it processes the skill's findings.
Ingestion points: scripts/run.mjs reads user-provided JSON or text files via the --input argument.
Boundary markers: No delimiters or safety warnings are applied to the external text before it is processed or reflected in the output.
Capability inventory: The skill uses Bash (via node) and Read (file system access) tools.
Sanitization: The scripts/engine/expense-compliance.js engine extracts data using regular expressions but does not sanitize the resulting strings against prompt injection patterns.
[EXTERNAL_DOWNLOADS]: The documentation suggests running npx -y @alipay/agent-payment@latest install to facilitate purchases. This command downloads and executes code from a package registry associated with a well-known financial service provider (Alipay).

expense-compliance-free