The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructions in SKILL.md and configuration in skill.yaml define a 'silent mode' that explicitly states 'do not stop to ask the user' (默认开启静默模式，不停止询问用户). This undermines the standard AI safety principle of human-in-the-loop and user consent.
[COMMAND_EXECUTION]: The skill provides an autonomous execution framework that includes 'auto-healing' with up to 999 attempts and the ability to dynamically search and generate new workflows from the internet. When combined with the 'never_stop' and 'silent_mode' flags, this creates a risk of high-frequency, unreviewed command execution on the host system.
[PROMPT_INJECTION]: The 'never_stop: true' and 'auto_execute: on_trigger: true' configurations in skill.yaml are designed to override the agent's default behavior of waiting for user confirmation between steps, effectively creating an unrestricted execution loop.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from external sources (official docs, GitHub issues, technical communities) and automatically convert this information into executable workflows.
Ingestion points: Network searches and GitHub repository reading during the 'Knowledge Research' and 'Workflow Matcher' layers.
Boundary markers: None identified in the provided instructions to distinguish between research data and trusted instructions.
Capability inventory: The skill has the capability to write files (creating directories, index.json, templates) and execute tasks/repairs.
Sanitization: No evidence of sanitization or verification of the content fetched from P3 (GitHub) or P4 (Tech Community) sources before it is used to generate executable steps.

autonomous-agent