The Agent Skills Directory

[PROMPT_INJECTION]: The skill knowledge base (specifically action_信号案例库.md) contains explicit instructions and examples for bypassing AI safety filters (jailbreaking). It demonstrates how to frame restricted requests, such as writing explicit content, under the guise of "comparative literature research" or other academic contexts.
[PROMPT_INJECTION]: The skill employs strong behavioral overrides and personality constraints, instructing the agent to have "zero tolerance" for certain user perspectives and to "immediately interrupt" users who do not follow the skill's core business philosophy.
[DATA_EXFILTRATION]: The skill's decision-tracking workflow involves managing a complex file-based state system that requires the agent to read and write markdown files in the user's home directory (specifically ~/.dbs/decisions/). While used for persistence, this capability increases the risk of local data exposure.
[PROMPT_INJECTION]: Vulnerability Surface (Indirect Prompt Injection):
Ingestion points: The agent context is populated by 4,176 "knowledge atoms" extracted from external social media posts stored in 原子库/atoms.jsonl and the various markdown files in Skill知识包/.
Boundary markers: Absent. The skill does not use unique delimiters or instructions to the agent to disregard instructions potentially embedded within the knowledge base excerpts.
Capability inventory: The agent is granted extensive file-write and project-management capabilities across the local project directory as defined in decision_结构与回填规则.md.
Sanitization: Absent. There is no evidence of automated filtering or sanitization of the knowledge atoms before ingestion.

dbs-benchmark