The Agent Skills Directory

[PROMPT_INJECTION]: The skill uses directive and authoritative language to override the AI agent's decision-making and planning process. It mandates that running the node script must be the 'FIRST action' and explicitly forbids the agent from providing explanations, planning narratives, or browsing files before execution (e.g., '禁止只解释用法而不执行', '中间不允许插入文件浏览、架构分析...'). This is a deliberate attempt to bypass the model's standard governance and planning layers by enforcing a 'Primary Action Contract'.
[REMOTE_CODE_EXECUTION]: In the SKILL.md prerequisites section, the skill documentation suggests a diagnostic command: curl -s http://127.0.0.1:9222/json/version | python3 -c "...". While this specific instance targets a local port for environment checks and uses a static processing script rather than executing arbitrary remote code, the structural pattern of piping network-derived output directly into a language interpreter is a high-risk coding practice and matches remote code execution heuristics.
[INDIRECT_PROMPT_INJECTION]: The skill presents an attack surface for indirect prompt injection because it processes content and URLs returned by external AI providers (Gemini, ChatGPT, etc.) as untrusted input.
Ingestion points: Untrusted data enters the context via AI responses processed in index.js and moodle_scraper.js.
Boundary markers: Explicit delimiters for the external content are not consistently present in the processing logic.
Capability inventory: The skill possesses capabilities for file system writes (fs.writeFileSync), network operations, and local command execution.
Sanitization: The author has implemented mitigations in isBlockedImageHost (blocking RFC1918, loopback, and link-local addresses) to prevent SSRF and local metadata exfiltration, though the injection surface for non-network attacks remains.
[COMMAND_EXECUTION]: The skill relies on shell command execution to interface with Node.js scripts for browser automation. The agent is directed to interpolate user prompts directly into command arguments (e.g., node ... "<prompt>"), which introduces a risk of command injection if the user input is not properly sanitized before being passed to the shell.

AgentChat-OneWeb