The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructions in SKILL.md direct the user to run npx -y shellward@latest, which fetches a package from the npm registry at runtime.
[REMOTE_CODE_EXECUTION]: By using npx with the @latest tag, the skill executes remote code that is not version-pinned. This introduces a supply chain risk where the audit tool could be compromised if the package is hijacked or updated with malicious code.
[COMMAND_EXECUTION]: The audit workflow requires the execution of multiple shell commands, including npx, directory creation (mkdir), and a custom validation script provided with the skill (node scripts/validate-findings.mjs).
[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and process untrusted project source code, creating a surface for indirect prompt injection attacks.
Ingestion points: The entire codebase of the target project being audited, specifically during Stage 1 ("摸清数据怎么流") and Stage 2 ("逐项取证") described in SKILL.md.
Boundary markers: Absent. The skill does not define specific delimiters or instructions to the LLM to treat the ingested code content purely as data.
Capability inventory: The skill has capabilities to read arbitrary files, write to the filesystem (.compliance/ directory), and guide the execution of shell commands.
Sanitization: The included scripts/validate-findings.mjs script performs sanitization by detecting and blocking PII (API keys, phone numbers, ID cards) from the final report, but there is no explicit input sanitization to prevent the auditor agent from being misled by instructions embedded in code comments or strings.

china-ai-compliance-audit