The Agent Skills Directory

[COMMAND_EXECUTION]: The skill contains an instruction to execute a local shell script at a fixed file path when specific trigger phrases are detected.
File: SKILL.md
Evidence: whipflow_run(mode="execute", source="let r = session \\"运行 /Users/qing/projects/pi-go/scripts/selftest.sh 并报告结果\\"")
Concern: The instruction specifies mode="execute" and explicitly tells the agent to execute directly ("直接执行"), which bypasses the preview and confirmation step defined in the skill's general execution rules.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests untrusted user data and interpolates it into the execution source of a powerful automation tool.
Ingestion points: User instructions for coding, debugging, or refactoring are captured and passed into the whipflow_run tool via the source parameter.
Boundary markers: The skill lacks delimiters or explicit instructions to ignore embedded commands within the user-provided text.
Capability inventory: The whipflow_run tool has the capability to execute complex workflows, run shell commands via the session keyword, and modify the local codebase.
Sanitization: There is no evidence of input validation, escaping, or sanitization before the user input is used to construct the dynamic execution script.

dev