The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface through its primary ingestion point: user-supplied field values in the trigger arguments.
Ingestion points: Arguments provided by the user in response to the skill's triggers (e.g., <type> [field-values] defined in SKILL.md).
Boundary markers: Absent for individual data fields. The skill does not define specific delimiters to isolate user input from the rest of the prompt context.
Capability inventory: The skill utilizes the Bash tool to execute an internal validation script (validate.js) and the Write tool to save generated CAD data to the file system.
Sanitization: Although the skill uses a validation script based on the Ajv library to ensure structural integrity of the generated data, it does not include logic to filter or sanitize input for embedded instructions.
[EXTERNAL_DOWNLOADS]: The skill's configuration files (README.md, package-lock.json) reference dependencies downloaded from a mirror of the official npm registry. These libraries (ajv and ajv-formats) are well-known and used for data validation purposes.
[COMMAND_EXECUTION]: The skill workflow involves the execution of a local Node.js script using the Bash tool. The agent is instructed to pass user-derived data as arguments to this script, which represents a capability that requires careful handling of shell interpolation by the AI platform.

easyeda-pro-format-skill