The Agent Skills Directory

[PROMPT_INJECTION]: The SKILL.md file contains a pre-written block of text designed to be sent to an AI assistant to automate the purchase of a 'buy-out' version. This block includes phrases like '我已授权安装依赖和发起购买' (I have authorized dependency installation and purchase initiation) and '不要替我确认' (Do not confirm for me). This is an attempt to override standard agent safety behaviors and bypass interactive user confirmation for high-risk actions such as financial transactions and software installation.
[EXTERNAL_DOWNLOADS]: The documentation instructs the agent to install the @alipay/agent-payment package via npx. This package belongs to a well-known service provider. The instructions include the -y flag (npx -y), which is used to bypass the interactive prompt for package installation, facilitating silent execution of remote code.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input (VAT calculation tables) provided as raw text or via JSON files. This represents a potential vulnerability surface for indirect prompt injection.
Ingestion points: Data enters the skill context through the loadInput function in scripts/run.mjs, which reads local files specified by the --input argument.
Boundary markers: The skill does not implement delimiters or specific 'ignore' instructions when passing the external input to its processing logic.
Capability inventory: The skill environment is granted the Read and Bash tools. While the skill's internal scripts (scripts/run.mjs and the engine) do not currently perform network operations or subprocess calls, the allowed-tools manifest gives the agent broad capabilities that could be targeted by malicious payloads in processed data.
Sanitization: The engine performs numeric parsing and strict table-structure validation (via normNumber and parseTable). This significantly reduces the risk of the data being interpreted as commands by the processing script itself, though it does not prevent the data from influencing the AI agent's subsequent analysis of the output.

vat-input-transfer-out-check-free