The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an Indirect Prompt Injection surface. It processes untrusted data (DOM snapshots and network logs) from external websites visited during the diagnostic phase. This data could be crafted by an attacker to manipulate the agent's subsequent logic for patching code.\n
Ingestion points: Data enters the agent's context through a diagnostic.json file generated from the stderr output of the opencli tool (SKILL.md).\n
Boundary markers: The skill uses ___OPENCLI_DIAGNOSTIC___ markers to identify the start and end of the data block, which provides some structural separation but does not prevent content-based injection.\n
Capability inventory: The agent has permissions to Read, Edit, and Write files, as well as execute Bash commands (SKILL.md frontmatter).\n
Sanitization: The instructions do not specify any sanitization or validation of the content within the DOM snapshot before it is used to inform code changes.\n- [COMMAND_EXECUTION]: The skill performs Dynamic Code Modification and Execution. It reads the source code of a script, applies patches based on externally influenced data, and then executes the modified script to verify the fix. This sequence is a classic attack surface for achieving persistent or malicious code execution if the input is compromised.\n- [COMMAND_EXECUTION]: The skill relies on the sourcePath property provided in the diagnostic JSON to identify the target file for modification. An attacker capable of influencing the tool's output could potentially redirect the Write operation to sensitive system files, leading to an Arbitrary File Write vulnerability.

qiaomu-opencli-autofix