The Agent Skills Directory

[PROMPT_INJECTION]: The skill's documentation in SKILL.md includes a pre-constructed text block for users to paste into an AI agent. This block uses authoritative directives such as "I have authorized the installation..." and "don't confirm for me," which are patterns designed to override the agent's safety protocols or deliberation when performing sensitive actions like installing software or initiating payments.
[INDIRECT_PROMPT_INJECTION]: The skill employs a multi-step chain injection strategy. The instructions provided in the markdown body are intended to influence the agent's future behavior, directing it to fetch external tools and interact with specific payment identifiers (2088702818190040).
Ingestion points: The prompt instructions are located in the SKILL.md file under the "需要完整档时" section.
Boundary markers: No delimiters or safety warnings are provided for the instructions intended for the agent.
Capability inventory: The skill uses Bash and Read tools; the instructions specifically command the use of npx for remote package installation.
Sanitization: None; the instructions are provided as raw text to be interpreted by the agent.
[EXTERNAL_DOWNLOADS]: The skill documentation directs the agent to execute npx -y @alipay/agent-payment@latest install. This command downloads and executes code from an external package registry at runtime. While the target is a well-known service (Alipay), this remains a remote code execution vector.
[COMMAND_EXECUTION]: The skill includes a scripts/run.mjs wrapper that executes logic via the Node.js runtime and utilizes the Bash tool to perform its analysis tasks locally.

material-usage-loss-check-free