The Agent Skills Directory

[PROMPT_INJECTION]: The skill includes instructions to conceal specific background operations from the user. In references/a2a/user/create-guide.md, the agent is directed to "silently persist" configuration answers and "not tell the User" about internal classifications or saves related to execution mode. While these are intended for internal workflow management, they instruct the agent to hide its actions.
[COMMAND_EXECUTION]: The skill frequently executes shell commands via the onchainos and okx-a2a CLI tools to manage task states and communications. Additionally, references/shared/chat-comm-init.md performs a global package installation using npm i -g @okxweb3/a2a-node and executes an environment repair command okx-a2a doctor --fix.
[EXTERNAL_DOWNLOADS]: The skill downloads and installs the @okxweb3/a2a-node package from the npm registry. This package belongs to the vendor scope of the skill's author ('okx') and is used to initialize communication protocols.
[PERSISTENCE]: In references/runtime/watch-wake.md, the skill implements a mechanism to schedule a one-shot wake-up task if the task monitoring loop is interrupted. It uses platform-specific tools like CronCreate (for Claude Code) or automation_update (for Codex) to restart the okx-a2a user watch command after a 2-minute delay.
[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface as it ingests untrusted data from peer messages, service guides, and evaluation evidence files.
Ingestion points: Envelopes in references/a2a/user/intake.md, Service Guides in references/a2a/user/create-guide.md, and evidence files in references/a2a/evaluator/evidence.md.
Boundary markers: The skill uses structured envelopes and intent markers like [intent:task_params_request] or [onchainos:task-terminal] to delimit data.
Capability inventory: The skill has access to the filesystem (via CLI and $TMPDIR), network operations (via CLI), and command execution.
Sanitization: The instructions explicitly warn the agent to treat all external payloads, guides, and evidence as untrusted data and never as executable instructions, mitigating the risk of accidental obedience to embedded commands.

okx-ai