The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions direct the agent to execute shell commands using values extracted directly from user-provided URLs. Specifically, the agent is told to extract a numeric ID from a URL and insert it into the command python3 download_photos.py --id [相册ID] --count 1. This pattern is vulnerable to command injection if the agent does not strictly validate the input, allowing an attacker to append shell metacharacters (e.g., ;, &&, |) to execute arbitrary system commands. Additionally, the mv command in SKILL.md (Step 6) uses a user-supplied target directory name, which could lead to path traversal if input like ../ is used.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input (URLs and folder names) and uses extracted components to drive tool execution.\n
Ingestion points: The agent extracts ID values from user-supplied URLs and destination folder names from user requests as described in SKILL.md.\n
Boundary markers: None. There are no instructions for the agent to validate the format or sanitize the extracted strings before using them in shell commands.\n
Capability inventory: The skill uses shell execution for python3, pip3, ls, wc, and mv commands across SKILL.md.\n
Sanitization: Absent. While the Python script download_photos.py uses type=int for the --id argument, this validation occurs after the shell has already parsed the command line, meaning shell-level injection remains possible. No sanitization is mentioned for the move destination path.

photoplus-downloader