The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes document content and search results retrieved from the Yuque API. Because the skill also possesses capabilities to modify or delete documents and repositories, this creates a surface where malicious instructions embedded in a Yuque document could influence the agent's actions.
Ingestion points: API data fetched in scripts/read-doc.mjs, scripts/search.mjs, and scripts/list-docs.mjs from the Yuque API.
Boundary markers: The skill incorporates a mandatory "preflight plan" logic in SKILL.md and references/safety-policy.md for destructive actions, requiring the agent to summarize impact before execution. However, it lacks specific prompt-level delimiters to isolate untrusted content from instructions.
Capability inventory: The skill includes scripts for document updates (scripts/update-doc.mjs), TOC reorganization (scripts/move-toc-node.mjs), and preflight planning for deletions (scripts/delete-doc-preflight.mjs, scripts/delete-repo-preflight.mjs).
Sanitization: Content from document bodies is returned directly to the agent context without explicit sanitization of potentially malicious instruction patterns.
[EXTERNAL_DOWNLOADS]: The skill interacts with the Yuque OpenAPI (https://www.yuque.com) to manage workspace resources. This is standard behavior for a service integration skill and targets an established productivity platform.
[CREDENTIALS_UNSAFE]: The skill uses a .env file for managing the YUQUE_TOKEN, as documented in README.md and docs/auth.md. This follows standard security practices for local development and secret management, ensuring sensitive tokens are not hardcoded in the source code.

yuque