The Agent Skills Directory

[COMMAND_EXECUTION]: The Preamble section contains a bash block that executes a script using a relative path: bash "$(dirname "${BASH_SOURCE[0]}")/../../check-update.sh". This is a risk because it attempts to execute code located outside the specific skill directory, which could lead to arbitrary command execution if the file system structure is manipulated or a malicious script is placed in the parent path.
[DYNAMIC_CONTEXT_INJECTION]: The skill uses an automated bash block in the Preamble that runs upon initialization. This block is used for environment setup (mkdir) and update checks, but it performs these actions silently before user interaction begins.
[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection:
Ingestion points: User responses collected via the AskUserQuestion tool in Steps 1 through 5 (SKILL.md).
Boundary markers: The skill lacks explicit boundary markers or instructions to treat user-provided data as untrusted content during the document generation phase.
Capability inventory: The skill has access to powerful tools including Bash, Write, and the Agent tool (as defined in allowed-tools and the Subagent section).
Sanitization: There is no evidence of sanitization, filtering, or escaping of the user-provided data before it is interpolated into the final output document docs/04-风控管理/跨部门协作方案.md.

pm-cross