The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions in skill.md and builder.md describe executing shell commands that include unvalidated user input. For example, the command python3 prompt_tool.py build "用户描述" passes a user-provided description directly as a shell argument. This presents a command injection risk where an attacker could execute arbitrary system commands by including shell metacharacters (e.g., ;, &&, |) in their input.
[PROMPT_INJECTION]: The skill is highly susceptible to Indirect Prompt Injection (Category 8) because it is designed to ingest and process untrusted prompt strings from users to extract features or optimize content.
Ingestion points: User-provided prompts are processed in extractor.md for feature extraction, optimizer.md for enhancement, and learner.md for discovery of new attributes.
Boundary markers: The analysis of skill.md and related modules reveals no use of delimiters (e.g., XML tags, triple quotes) or explicit instructions to the agent to ignore instructions embedded within the processed data.
Capability inventory: The skill has the capability to execute local shell commands (prompt_tool.py) and perform file system operations (read/write JSON libraries in /Users/huangzongning/prompt_gen_image/).
Sanitization: There is no evidence of input validation, escaping, or sanitization of the user-supplied prompt strings before they are processed by the tool logic or passed to LLM calls in the learner module.

prompt-master