The Agent Skills Directory

[COMMAND_EXECUTION]: Unescaped placeholder variables such as {关键词}, {title}, and {chapter_num} are directly interpolated into bash shell command arguments throughout SKILL.md. If these values contain unvalidated shell metacharacters, it could lead to unexpected shell argument or command injection when interpreted by the Bash tool.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection attack surface by processing untrusted project files and inputs.
Ingestion points: Reads data from novel drafts, chapter outlines (chapter_{NNN}.json), user queries ({关键词}), and project state snapshots (.webnovel/state.json) in SKILL.md.
Boundary markers: Absent. No explicit delimiters or guidelines instruct the agent to ignore hidden instructions embedded within the creative text or metadata.
Capability inventory: The agent has robust capabilities, including filesystem access (Read, Write, Edit), shell command execution (Bash), and subagent orchestration (Agent).
Sanitization: Absent. The external text values are interpolated into workflows without active filtering or sanitization.
[DYNAMIC_EXECUTION]: In Step 3 of SKILL.md, the workflow runs an inline one-liner script (python -X utf8 -c "...") to dynamically format and write a boilerplate fallback JSON file to the disk. Although this script uses predefined templates, dynamically constructing and executing script arguments at runtime represents a minor dynamic execution footprint.

webnovel-write