The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the shell to execute a compliance check: python3 -m siyu_team.eval.cli score "{报告路径}". The {报告路径} variable incorporates the {客户} (client) string, which is provided by the user via the --client argument. An attacker providing a client name containing shell metacharacters (e.g., semicolons or backticks) could trigger arbitrary code execution on the host system when the shell evaluates the command string.
[DATA_EXFILTRATION]: The skill systematically reads sensitive customer consultation archives stored in the user's home directory (~/.siyu/clients/). While this is the intended primary function for merging reports, the programmatic access to private local consultation records represents a significant data exposure surface.
[PROMPT_INJECTION]: The skill processes untrusted content from multiple archive files. It lacks explicit boundary markers or instructions to ignore potential malicious prompts embedded within these external data sources, creating a vulnerability to indirect prompt injection where instructions inside an archive could influence the agent's behavior during the report generation process.
Ingestion points: Files located in ~/.siyu/clients/{客户}/ (SKILL.md).
Boundary markers: None identified in the merging instructions.
Capability inventory: Subprocess execution via python3 -m siyu_team.eval.cli (SKILL.md).
Sanitization: None specified for the content of the archives or the user-provided client name string.

siyu-report