The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources as defined in the SKILL.md workflow (Step 2: 'URL 资料先获取真实内容'). This fetched content is used to generate Markdown documents. While Step 3 and Step 4 include logic to exclude credentials, the lack of explicit boundary markers or instruction-level sanitization for the generated Markdown body creates a surface where malicious instructions within a fetched web page could influence the agent's behavior during the summarization or indexing process. Evidence Chain: 1. Ingestion point: SKILL.md workflow step 2 (URL fetching). 2. Boundary markers: Absent for the Markdown content generation phase. 3. Capability inventory: File system writes to index.jsonl and profile writes via scripts/profile_store.py. 4. Sanitization: Credentials are blacklisted in scripts/profile_store.py, but the natural language content is not filtered for embedded instructions.- [SAFE]: The skill demonstrates secure development practices in its profile management utility. The scripts/profile_store.py tool includes a SENSITIVE_PARTS blacklist (token, secret, password, credential, cookie, api_key, apikey) that actively prevents these sensitive fields from being persisted into the user's durable profile. Additionally, SKILL.md provides explicit execution boundaries that prevent the skill from bypassing protections or auto-sending messages without user confirmation.

lov-memory-add