The Agent Skills Directory

[COMMAND_EXECUTION]: The instruct.md file directs the agent to execute shell commands to remove existing skill directories using rm -rf and Remove-Item during the setup process. Additionally, the skill includes instructions for modifying user shell profiles (such as ~/.bashrc, ~/.zshrc, or $PROFILE) to persist environment variables, which acts as a persistence mechanism.
[EXTERNAL_DOWNLOADS]: The skill's installation flow downloads multiple Javascript modules and a manifest file from the vendor's domain (https://qveris.cn/skill/). These scripts are subsequently executed by the agent to provide the skill's core functionality.
[PROMPT_INJECTION]: The skill uses strong instructional language in skill.md to override the agent's default behavior, such as mandating the use of the QVeris tool over internal knowledge or other search tools for specific data types.
[DATA_EXFILTRATION]: The skill accesses the QVERIS_API_KEY from the environment and transmits it to the vendor's API endpoint (https://qveris.cn/api/v1) to authenticate tool discovery and execution requests.
[PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface by processing and displaying results from an external API.
Ingestion points: Data enters the agent context through the callTool and discoverTools functions in qveris_client.mjs, which fetch JSON responses from the remote API.
Boundary markers: The instructions lack explicit boundary markers or warnings to the agent to ignore embedded instructions within the API results.
Capability inventory: The skill has the capability to perform network requests and execute shell commands (via the installation script).
Sanitization: The skill uses standard JSON parsing but does not perform content-level sanitization or filtering on the text returned by the tools before displaying it to the user.

qveris-cn