The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill creates a multi-step pipeline where output from one AI (e.g., Kimi's search results) is fed as a prompt into another (Gemini/ChatGPT/Claude). This creates a surface for indirect prompt injection where malicious content retrieved from the web or generated by a sub-agent could influence the master agent's behavior.
Ingestion points: The skill ingests untrusted data via Step 2 (--search results from Kimi) and Step 5 (--review comments from ChatGPT) which are processed by the main agent and other sub-agents.
Boundary markers: While SKILL.md suggests prompt templates (e.g., 待审查产出: ...), the wrapper script index.js does not implement programmatic delimiters or escaping to isolate untrusted content from instructions.
Capability inventory: The script index.js has the capability to execute the sibling skill AgentChat-OneWeb/index.js, and the master agent (Claude) has full file-system and tool access.
Sanitization: No explicit sanitization, filtering, or instruction-override protection is implemented in the script when interpolating sub-agent outputs into new prompts.

AgentChat-WebSubAgent