The Agent Skills Directory

[COMMAND_EXECUTION]: The skill directs the agent to execute shell commands such as cp, ls, and git mv to establish the directory structure and migrate files. It also runs local Python scripts (search-yaml.py, validate-yaml.py) provided within the skill package to manage metadata.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it glob-searches and reads markdown files from the target repository to perform auditing and migration. Malicious content within these files could attempt to subvert the agent's logic during the onboarding process.
Ingestion points: The skill reads all markdown files found in the repository (excluding .git and node_modules) during the '启动检查' (Startup Check) and '迁移路径' (Migration Path) phases as defined in SKILL.md.
Boundary markers: There are no explicit delimiters or instructions provided to the agent to treat the content of scanned files as untrusted or to ignore embedded instructions.
Capability inventory: The skill possesses capabilities to write to the file system (cp), rename files (git mv), and execute scripts, which could be abused if an injection is successful.
Sanitization: The skill does not implement any validation or sanitization of the content extracted from existing markdown files before the agent processes them.

cs-onboard