The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon instructions found in external files like proposal.md and tasks.json. This architecture presents a significant surface for indirect prompt injection, as an attacker who can modify these files could direct the agent to perform unauthorized actions. Ingestion points: Files located at spec/changes/{change-id}/proposal.md and spec/changes/{change-id}/tasks.json. Boundary markers: The instructions lack delimiters or warnings to treat the file content as untrusted data. Capability inventory: The agent is empowered to modify code, run shell commands (npm, pytest, curl), and use remote access tools (ssh). Sanitization: The skill lacks instructions for the agent to sanitize or validate the external file content.
[COMMAND_EXECUTION]: Reference materials provided in the skill include high-risk shell commands with a hardcoded IP address and root user access (ssh root@167.71.39.50). Instructing an agent to perform remote administrative access to a specific external IP address is a dangerous pattern that could lead to unauthorized access or exposure of infrastructure.
[PRIVILEGE_ESCALATION]: The skill's documented deployment and maintenance workflows explicitly reference the use of the root administrative account on remote systems, which involves operating with elevated privileges.

openspec-implementation-cn