The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local binaries including grok, kimi, and claude through the main wrapper script scripts/qiaomu_model_cli.py and diagnostic script scripts/check_env.py. These calls use subprocess.Popen and subprocess.run with arguments passed as lists rather than shell strings (shell=True is not used), which is a secure practice that prevents command injection.
[PROMPT_INJECTION]: An indirect prompt injection surface was identified in the dual command logic within scripts/qiaomu_model_cli.py. This mode creates a pipeline where the stdout from a Grok research task is interpolated directly into a prompt for a Kimi implementation task. Because there are no boundary markers or sanitization steps, a malicious payload retrieved by the research model (e.g., from an attacker-controlled X post or website) could influence or override the instructions for the implementation model.
Ingestion points: In scripts/qiaomu_model_cli.py, the research string obtained from the first model is interpolated into the kimi_prompt variable.
Boundary markers: None. The content is concatenated as raw text.
Capability inventory: The skill can perform file writes and command execution via the underlying CLIs, especially when the bypassPermissions flag is utilized as intended for coding tasks.
Sanitization: No filtering or escaping is applied to the output of the research model before reuse.

qiaomu-model-cli