The Agent Skills Directory

[COMMAND_EXECUTION]: The exec-token action implemented in scripts/exec-token.js allows the AI agent to execute arbitrary shell commands through the use of execSync with the { shell: true } option. This capability permits the execution of any system command provided as an argument, which could be abused to perform unauthorized actions on the host system.\n- [INDIRECT_PROMPT_INJECTION]: The skill instructions in docs/help.md direct the agent to fetch and process content from external URLs (https://apifox.newapi.ai/llms.txt and https://www.newapi.ai/llms.txt) to answer user queries.\n
Ingestion points: The agent fetches untrusted data from the specified remote llms.txt endpoints in docs/help.md.\n
Boundary markers: There are no explicit boundary markers or instructions to ignore instructions embedded within the fetched content.\n
Capability inventory: The skill has high-privilege capabilities including shell command execution (scripts/exec-token.js) and file modification (scripts/inject-key.js).\n
Sanitization: The skill lacks mechanisms to sanitize or filter potential prompt injection attacks contained within the remote documentation.\n- [DATA_EXFILTRATION]: The skill relies on scripts/sanitize.js to redact sensitive API keys (sk- tokens) and secrets from output before it is returned to the agent. This regex-based approach is inherently brittle and may be bypassed by variations in character encoding, unusual formatting, or multi-line configurations, potentially leading to the exposure of sensitive credentials to the AI context or logs.\n- [DYNAMIC_EXECUTION]: The scripts/exec-token.js script dynamically constructs shell commands at runtime by substituting placeholders with API keys fetched from a remote server, then executes the resulting string in a system shell.

newapi