The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted content from a user's web novel project, creating a surface for indirect prompt injection.
Ingestion points: Reads project configuration, chapter data, and state files including .story-system/MASTER_SETTING.json, .story-system/volumes/*.json, .story-system/chapters/*.json, .webnovel/state.json, and index.db (referenced in SKILL.md).
Boundary markers: The instructions do not define any delimiters or explicit instructions for the agent to ignore embedded commands within the story files it reads.
Capability inventory: The skill has access to the Bash, Read, and Grep tools, allowing it to execute local scripts and access the file system.
Sanitization: There is no mention of sanitization, validation, or escaping of the project data before it is processed or used in queries.
[COMMAND_EXECUTION]: The skill uses the Bash tool to execute a local Python utility script (webnovel.py) for querying the project's data store.
Evidence: SKILL.md contains several bash commands that invoke python "${SCRIPTS_DIR}/webnovel.py" with various flags like knowledge query-entity-state, memory-contract query-rules, and load-context. These are executed within the local plugin environment.

webnovel-query