The Agent Skills Directory

[COMMAND_EXECUTION]: The wrapper script scripts/ima_kb_tool.py uses subprocess.run() to invoke a secondary logic script (ima_tool.py). Although it passes arguments as a list to avoid shell-level command injection, it dynamically constructs the command based on user input.
[DATA_EXFILTRATION]: The upload-file command in scripts/ima_tool.py enables the reading of arbitrary local files and their subsequent upload to the IMA OpenAPI service (ima.qq.com). This capability could be leveraged to exfiltrate sensitive local data, such as private keys or configuration files, if the agent is directed to access unintended paths.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the IMA knowledge base via the search-kb and inspect-kb-hit commands. This external content is incorporated into the agent's context without sanitization or protective boundary markers, allowing potentially malicious instructions embedded in the knowledge base to influence the agent's actions.
Ingestion points: API responses from the search_knowledge and get_knowledge_list endpoints (handled in scripts/ima_tool.py).
Boundary markers: No explicit delimiters or instructions to ignore embedded commands are included in the tool's output to the agent.
Capability inventory: The skill possesses capabilities for local file reading, network data transmission, and subprocess execution.
Sanitization: No filtering or sanitization is applied to the retrieved knowledge base fragments before they are returned to the agent context.

ima-knowledge-base