The Agent Skills Directory

[COMMAND_EXECUTION]: The skill's preamble executes a local bash script located at a relative path outside the skill's directory.
Evidence: bash "$(dirname "${BASH_SOURCE[0]}")/../../check-update.sh" 2>/dev/null || true in SKILL.md.
Impact: Executing scripts from relative parent directories can lead to the execution of unverified or unexpected code if the environment structure is modified.
[PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it ingests untrusted data from users and interpolates it into persistent documentation.
Ingestion points: User responses to various AskUserQuestion prompts in Steps 1 through 4 of the execution flow.
Boundary markers: Absent. User-provided risk descriptions and choices are directly inserted into the markdown template.
Capability inventory: The skill has access to Write (for document creation), Bash (for preamble execution), and Agent (for subagent spawning).
Sanitization: None. The skill does not validate or escape the content provided by the user before writing it to docs/04-风控管理/风险管控方案.md.
Impact: A malicious user could provide input designed to influence the behavior of downstream skills or agents that read the generated risk management documents.

pm-risk