The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructions explicitly direct the agent to suppress interactive confirmation and feedback loops during task execution (e.g., "不主动提问", "不要问我问题"). The runtime manifest (skill.yaml) enforces this by setting max_questions: 0 and ask_missing: false. This effectively overrides the standard interactive safety model of the agent platform for the duration of the session.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection due to its autonomous data processing loop.
Ingestion points: Reads project-specific files, task goals, and user profile data (user-profile/v1) as defined in SKILL.md and managed via scripts/profile_store.py.
Boundary markers: The skill mentions respecting "upper-level rules" and "authorization boundaries" in references/skill-composition.md, but it lacks explicit structural delimiters (e.g., XML tags or clear markers) to prevent the agent from confusing data with instructions when processing untrusted files in YOLO mode.
Capability inventory: The skill is capable of file system writes, command execution (exec), and tool orchestration as part of its "Execution Loop".
Sanitization: The scripts/profile_store.py script includes a blocklist for sensitive keys (e.g., tokens, secrets, passwords) when persisting profile data, which is a positive security control. However, there is no evidence of sanitization for natural language instructions that might be embedded in the external data the agent reads.
[COMMAND_EXECUTION]: The core functionality of the skill involves the autonomous execution of shell commands and filesystem operations without individual user approval for each step. This increases the potential impact of errors or malicious injections if the agent is directed toward harmful actions in its unattended state.

lov-yolo-mode