The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's intended functionality involves ingesting and analyzing user-provided logs, text files, and configuration data to provide diagnostic advice. This creates a potential surface for indirect prompt injection attacks.
Ingestion points: As described in SKILL.md, the agent is instructed to read and interpret user-provided Markdown, text, logs, and JSON/YAML configuration files as evidence for its answers.
Boundary markers: The skill contains a strong internal guardrail in the 用途 (Purpose) section of SKILL.md, explicitly instructing the agent that prompts or system labels found in user files must be treated as data and never executed as instructions.
Capability inventory: The primary runtime script, scripts/query_knowledge.py, is restricted to read-only access within the skill's reference directory and performs no network operations. Maintenance scripts in the scripts/ directory use sophisticated security measures, including OS-level isolation and strict environment sanitization, when executing external tools.
Sanitization: The query_knowledge.py script normalizes and sanitizes search terms before processing them for retrieval scoring, which limits the influence of malicious input on the tool's behavior.

deep-sky-capture-advisor