The Agent Skills Directory

[PROMPT_INJECTION]: The knowledge base file 知识库/Skill知识包/deconstruct_解构案例库.md (Entry 2025Q4_278) provides a specific example of how to bypass AI safety filters. It demonstrates reframing a prohibited request for erotic content as a sophisticated academic study on "body philosophy in French literature" to evade model safety protocols.
[COMMAND_EXECUTION]: The skill's core logic, defined in 知识库/Skill知识包/decision_AI协作规则.md and 知识库/Skill知识包/decision_结构与回填规则.md, requires the agent to perform complex file system operations. It is instructed to create directories, write new Markdown files, archive old content, and modify local state files (e.g., 我的当前状态.md, 开放问题.md) in sensitive locations such as the user's home directory (~/.dbs/decisions/).
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted user descriptions and interpolates them into a report template (SKILL.md) and local project files (01_事实/客观事实.md).
Ingestion points: Conversational user input is processed in the Phase 3 report template in SKILL.md using the {用户说的话} placeholder.
Boundary markers: None identified; user input is directly embedded into structured Markdown.
Capability inventory: The agent has the authority to read/write/modify local files and directories (defined in decision_AI协作规则.md).
Sanitization: There are no instructions to sanitize or filter the user-supplied content before it is processed or saved to the file system.
[DATA_EXFILTRATION]: The skill framework includes mechanisms for managing highly sensitive data, including "Privacy maps" (代号映射.md) that link user-defined codenames to real identities, and mentions automated tools for logging into Google accounts to manage subscriptions (2026Q1_185). Storing such sensitive mappings in locally accessible Markdown files without encryption creates an exposure risk.

dbs-action