The Agent Skills Directory

[PROMPT_INJECTION]: The skill includes a specific block of text in SKILL.md under the section '需要完整档时（可选）' designed to be sent verbatim by the user to the AI agent. This block ('请通过 SkillPay 购买并安装...') contains complex instructions that direct the agent to perform a sequence of actions including external command execution, reading specific files, and facilitating a commercial transaction. This is an instruction hijacking technique to override the agent's behavior.
[METADATA_POISONING]: The skill's description and body (in SKILL.md) are heavily oriented towards promoting a 'Buyout Version' (买断版) of the tool. It directs users to an external storefront and provides official purchase instructions, shifting the skill's utility towards a commercial funnel.
[EXTERNAL_DOWNLOADS]: The upsell instructions direct the agent to execute npx -y @alipay/agent-payment@latest install. This command downloads a software package from the NPM registry and executes it immediately. While the package belongs to a well-known service (Alipay), the method of prompting the agent to download and run code from a suggested text block is a potential supply chain risk.
[COMMAND_EXECUTION]: The skill requests Bash permissions and provides specific command-line instructions for the agent to execute installation scripts (npx) as part of its upsell flow.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied milestone tables which may contain untrusted data.
Ingestion points: The run function in scripts/engine/software-outsource-milestone-check.js accepts raw text via payload.text.
Boundary markers: None. The parser splits data by tabs or whitespace without delimiters.
Capability inventory: The skill has Read and Bash capabilities, which are used to process files and execute the upsell commands.
Sanitization: No sanitization is performed; input values are trimmed and interpolated directly into findings messages that the agent reads.

software-outsource-milestone-check-free