The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources and processes it within the agent's context, which creates a potential vector for indirect prompt injection.
Ingestion points: Untrusted data enters the agent context through import_urls (fetching external web content), file uploads processed by preflight-check.cjs, and user-provided external links or text灵感.
Boundary markers: The instructions do not define explicit delimiters or instructions to the agent to treat external content as inert data, which may allow instructions embedded in that content to influence the agent's subsequent actions.
Capability inventory: The skill has extensive capabilities to modify the user's environment, including creating and appending to notes (import_doc, append_doc, update_note) and managing knowledge base entries (add_knowledge, move_knowledge).
Sanitization: The skill performs technical validation (UTF-8 checks in ima_api.cjs and file type/size validation in preflight-check.cjs), but it does not semantically sanitize the content for malicious instructions before storage.
[COMMAND_EXECUTION]: The skill relies on shell command execution to perform its primary PKM automation tasks.
Evidence: It executes local Node.js scripts (ima_api.cjs, cos-upload.cjs, note-images.cjs) to handle API requests and file uploads. It also uses git commands (git remote get-url, git branch --show-current) to resolve local file paths to remote repository URLs. These operations are directly tied to the primary purpose of the skill.

ybrain