The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary purpose is to fetch and process untrusted external data (articles, transcripts, social media posts) to generate new system instructions (SKILL.md files). This creates a large attack surface where a malicious webpage or video transcript could contain instructions that influence the agent's behavior during the 'distillation' process or within the final generated skill.
Ingestion points: The agent is instructed to use tools like web-article-reader, agent-reach, and bash download_subtitles.sh to fetch external content into its context.
Boundary markers: The instructions in SKILL.md lack explicit delimiters or 'ignore' warnings for the ingested content, though they do advise the agent to distinguish between 'what he said' and 'what I inferred'.
Capability inventory: The agent has the capability to execute shell commands (bash), run Python scripts (python3), and spawn subagents.
Sanitization: The skill performs basic text cleaning via scripts/srt_to_transcript.py but lacks robust security filtering for the generated markdown files.
[EXTERNAL_DOWNLOADS]: Automated security scans identified several high-risk URLs within the persona research files located in the examples/ directory. Specifically, ijels.com was flagged as a Botnet and blog.auspiciousassociates.com as a Phishing site. While these appear to be part of the research corpus for the analyzed figures, they represent a risk if the agent visits them to refresh data.
[COMMAND_EXECUTION]: The skill package includes local Python and Bash scripts in the scripts/ directory which the agent is instructed to execute for data processing tasks like downloading subtitles (download_subtitles.sh) and performing quality checks on generated files (quality_check.py). This represents an execution surface that could be abused if the scripts themselves or their inputs are compromised.
[REMOTE_CODE_EXECUTION]: The documentation encourages the installation of the skill and its derivatives via npx skills add, which facilitates the download and execution of code from the alchaincyf repository on GitHub. This constitutes a supply chain risk if the external repository is compromised.

huashu-nuwa