The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill includes explicit safeguards against the leakage of sensitive data, instructing the agent never to output or record tokens, refresh tokens, or secrets during document operations, even when requested by the user.
[COMMAND_EXECUTION]: Strict security boundaries are established for file operations; the instructions restrict the agent to working with relative paths within the current working directory and specifically prohibit absolute paths or directory traversal attempts (e.g., '..') in file-handling commands such as +import and +create.
[INDIRECT_PROMPT_INJECTION]: The skill is exposed to an indirect prompt injection surface through the ingestion of untrusted document content. This risk is well-mitigated by requirements for structured data processing via JSONML validation schemas and instructions for the agent to use immutable resource identifiers, which reduces reliance on potentially malicious instructions embedded in documents.

dingtalk-doc