The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted external data, such as product prototypes, PRD documents, or requirement drafts provided by the user. This creates a potential surface for indirect prompt injection, where malicious instructions hidden within those documents could attempt to subvert the agent's logic during the extraction and summarization process. \n
Ingestion points: The agent is instructed in SKILL.md under the "原型/文档识别" step to read and extract functional descriptions from user-provided files.\n
Boundary markers: The instructions lack explicit boundary markers or directives to treat external file content as data only, increasing the risk of the agent accidentally following instructions embedded in those files.\n
Capability inventory: The skill is restricted to Read and Write tools as defined in the frontmatter of SKILL.md. It lacks network access or shell execution capabilities, which significantly limits the potential impact of a successful injection.\n
Sanitization: There are no explicit sanitization or filtering steps mentioned for the content extracted from external documents before it is processed or written to the output requirement file.

requirements-analysis