The Agent Skills Directory

[METADATA_POISONING]: The skill includes a file named .security-scan-passed that falsely claims a security scan was performed and passed at a future date. This represents a deceptive self-referential safety claim designed to influence security evaluations.
[CREDENTIALS_UNSAFE]: The skill is instructed to read ~/.config/setup-notifications-via-wecom/config.json to obtain a WeCom webhook_url, which is a sensitive credential. Accessing files in the user's config directory for secrets constitutes a data exposure risk.
[INDIRECT_PROMPT_INJECTION]: The skill processes local configuration data to decide whether to bypass human confirmation for message sending. This relies on the agent's reasoning over untrusted local state to enforce security boundaries.
Ingestion points: Reads recipient_scope and recipient_label from the config file in the user's home directory.
Boundary markers: Instructions define a 'Human confirmation boundary' but lack technical enforcement beyond natural language.
Capability inventory: Performs network requests to external WeCom endpoints via curl or bundled scripts.
Sanitization: No validation or escaping of the message content or configuration values is described.

notify-wecom