The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to perform file system operations using shell commands (mkdir -p, mv). The paths and filenames are constructed using {公司名稱} and {姓名}, which are extracted directly from user-uploaded images. There is no validation or sanitization process defined, creating a risk where malicious text in a business card image could lead to command injection (e.g., a name containing ; rm -rf /).
[PROMPT_INJECTION]: The skill uses specific language to compel the agent to ignore other instructions or system rules ("重大注意事項 (Red Flag) 絕對不允許找藉口", "這是特例！請強行覆寫這個一般性規則！"). This behavior-steering technique is characteristic of prompt injection aimed at overriding established safety or operational guardrails.
[INDIRECT_PROMPT_INJECTION]: The skill presents a vulnerability surface for indirect prompt injection as it processes untrusted external data (images) and uses the resulting output in high-privilege actions like shell execution.
Ingestion points: Text extraction from business card images in Step 1.
Boundary markers: Absent; the agent is not instructed to treat the extracted text as untrusted data.
Capability inventory: Shell command execution (mv, mkdir, find), directory creation, and file modification across the vault.
Sanitization: None; the extracted strings are interpolated directly into shell script blocks.

business-card-ingestion