The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute multiple shell commands for file analysis, including unzip, find, xxd, strings, and grep. It also provides instructions for installing system-level packages using apt, dnf, or pacman to set up the analysis environment.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted external data in the form of HarmonyOS application packages (.hap, .hsp, .har) and ArkCompiler bytecode (.abc).
Ingestion points: Commands in SKILL.md (Steps 1, 2, and 3) such as unzip -l, xxd, strings, and grep read data from external files and present it to the agent.
Boundary markers: The skill does not define specific delimiters or warnings to prevent the agent from following instructions that might be embedded as strings within the analyzed application's code or resources.
Capability inventory: The agent has the capability to execute shell commands, read files, and potentially write to the file system during the analysis process.
Sanitization: There is no mention of sanitizing or filtering the output of strings or grep results before the agent processes them, which could allow a malicious application to influence the agent's behavior via specially crafted strings.

re-harmonyos