The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructions in SKILL.md include a pre-defined text block intended to be processed by the AI agent that uses authoritative language ("我已授权安装依赖"
I have authorized the installation of dependencies). This is a directive designed to bypass or pre-empt user confirmation prompts for tool execution, which can lead to reduced oversight of system-level actions.- [REMOTE_CODE_EXECUTION]: The documentation provides instructions to execute npx -y @alipay/agent-payment@latest install. This pattern involves downloading and executing remote code from an external package registry.
Evidence: Found in the "How to buy" section of SKILL.md.
Context: The target package originates from a well-known service provider.- [INDIRECT_PROMPT_INJECTION]: The skill ingests and parses external data (freight bills) into the agent's context. The lack of delimiters or sanitization allows malicious instructions embedded in input files to potentially influence the agent's behavior.
Ingestion points: The loadInput function in scripts/run.mjs reads content from user-specified files.
Boundary markers: No delimiters or explicit "ignore" instructions are used when interpolating file content into the processing logic.
Capability inventory: The skill operates in an environment with Bash and Read tool access.
Sanitization: No input validation or escaping is applied to the raw text before parsing by the freight-reconciliation.js engine.

freight-reconciliation-free