The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill relies on 'content cards' (内容卡_*.md) or user-pasted 'transfer cards' to maintain state across different steps. This mechanism allows untrusted data to influence the agent's execution flow and parameters for subsequent sub-skills.
Ingestion points: Files named 内容卡_*.md in the current working directory and user-provided 'transfer cards' (交接卡) in the chat history.
Boundary markers: The skill does not define specific delimiters or instructions to ignore potential commands within these state files.
Capability inventory: The skill has the ability to read and write files, as well as locate and read instructions from other markdown files (SKILL.md).
Sanitization: There is no mention of sanitizing, escaping, or validating the content of the cards before processing.
[DYNAMIC_EXECUTION]: The skill dynamically identifies, reads, and follows instructions from various sub-skill files (e.g., li-material-mining, li-worth-shooting) based on the current step in the workflow. While these are local files, this dynamic loading of instructions from computed paths constitutes a dynamic execution pattern for AI agents.
Evidence: Instructions such as 'Locate and fully read the SKILL.md of that step, execute according to its method' and 'First use the skill paths discovered by the host; if not, search by machine name in the same directory as the current Skill.'

li