The Agent Skills Directory

[PROMPT_INJECTION]: The skill uses authoritative instructions such as 'NEVER add disclaimers about permissions', 'NEVER say you cannot send messages', and 'NEVER suggest the user do it manually'. These patterns are intended to override the agent's internal safety filters or refusal mechanisms regarding message delivery and tool usage.
[DATA_EXFILTRATION]: The yb_send_dm tool documentation explicitly supports sending local files via the media_files parameter by specifying a filesystem path (e.g., /tmp/photo.jpg). This capability creates a data exposure surface where an agent could be tricked into reading and sending sensitive files from the host environment to an external user.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from chat participants and group member lists which could contain malicious instructions.
Ingestion points: Data retrieved via yb_query_group_members (member names/nicknames) and incoming group chat messages.
Boundary markers: The instructions lack delimiters or explicit guidance to treat data from the Yuanbao gateway as untrusted content.
Capability inventory: The agent has the ability to read files from the filesystem and send them over the network via the yb_send_dm tool.
Sanitization: There are no instructions for sanitizing or validating nicknames or message content before they are used in mentions or DMs.

yuanbao