The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute local Python scripts, such as record_published.py and oral_script_check.py, using shell commands. These calls use parameters like URLs and file paths derived from user input or platform metadata. If these inputs are not properly sanitized before being passed to the shell, it could lead to command injection.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external content, which presents a surface for indirect prompt injection.
Ingestion points: Data enters the agent's context through a local automation task queue (50-系统/40-自动化/AI任务队列.md) and user-provided materials like ideas, article drafts, and research data.
Boundary markers: The skill uses operational 'confirmation gates' and specific frontmatter fields (e.g., publish_exclude_sections) to filter content before platform delivery. However, it lacks explicit technical sandboxing or delimiters to prevent the agent from being influenced by instructions embedded within the processed materials.
Capability inventory: The skill is capable of executing shell commands, performing file system operations (read/write), and interacting with web platform APIs for WeChat and X via its constituent sub-skills.
Sanitization: There is no evidence of input validation or escaping of external content before it is processed by the agent or passed as arguments to local scripts.
[DYNAMIC_EXECUTION]: The skill relies on runtime execution of local scripts (record_published.py, knowledge_ingest.py) to handle post-publication logic and update task states. This behavior is documented as part of the intended workflow but requires the user to maintain the integrity of their local script environment.

ray