The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external content, including user-provided drafts and viral hit descriptions, which creates an attack surface for instructions hidden in processed data. • Ingestion points: User text inputs in Mode A (draft diagnosis), Mode B (viral decoding), and Mode C (phenomenon analysis) as defined in SKILL.md. • Boundary markers: The skill lacks explicit prompt delimiters or instructions to ignore embedded commands in the user-provided data. • Capability inventory: The skill performs read and write operations to the local file system, specifically within the zmm/references/ and {vault}/08-技能记忆/ directories. • Sanitization: There is no evidence of sanitization or filtering of external content before it is processed by the agent.
[DATA_EXFILTRATION]: The skill is configured to read from and write to specific local directory paths for configuration and memory management. While these appear to be application-specific, they represent a persistent file system access surface that could be targeted if the agent's context is compromised.

zmm-resonate