The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from external web searches (referred to as 'Web 补查') to supplement report content. This creates a surface where malicious instructions embedded in external web content could potentially influence the agent's behavior. The skill lacks explicit instructions for sanitizing or escaping this external input, and no boundary markers are defined to separate untrusted data from the system instructions.
Ingestion points: External data retrieved during the mandatory web search phase ('Web 补查') as specified in the Hardness Gates (E53) and Core Workflow.
Boundary markers: Absent; there are no instructions to use delimiters or 'ignore' instructions for the retrieved web content.
Capability inventory: The skill writes HTML files to the @session/ directory and references a scripting tool (run_script in rule E26).
Sanitization: Absent; the instructions focus on data accuracy and source attribution rather than escaping or validating content to prevent injection attacks.
[DATA_EXFILTRATION]: The skill instructions mandate performing at least one web search ('Web 补查') for every report to gather news, termination events, and external validation. This involves network requests to external, non-whitelisted domains.
[DYNAMIC_EXECUTION]: The skill defines a constraint (rule E26) for a run_script tool, requiring parameters to be passed as an array of strings. While this indicates the agent has access to script execution capabilities, the skill does not explicitly command the execution of untrusted or dynamically generated code from remote sources, representing a standard usage of platform tools.

pharma-project-initiation-report