The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The installation guide instructs users to clone a repository from an unverified GitHub account (ziqihe10-droid/xuefeng-agent). Downloading files from non-trusted third-party sources is a common vector for supply chain attacks.
[REMOTE_CODE_EXECUTION]: The skill recommends executing the downloaded code locally using python server.py. Because the code resides in an external, unverified repository, this action could result in the execution of arbitrary malicious scripts if the source is compromised or malicious.
[COMMAND_EXECUTION]: The setup process requires the user to run multiple shell commands, including pip install for several packages and direct execution of a Python server, which increases the attack surface if the environment is not isolated.
[INDIRECT_PROMPT_INJECTION]: The skill implements a web_search function that retrieves data from Baidu and Tavily.
Ingestion points: External search snippets from https://www.baidu.com/s?wd={query} and the Tavily API are ingested into the agent's context.
Boundary markers: The provided prompt snippets do not demonstrate the use of clear delimiters or instructions to ignore malicious data embedded in the search results.
Capability inventory: The agent has the capability to query a local SQLite database (admission_clean.db) and process user data via an LLM.
Sanitization: No evidence of sanitization or filtering for external content is provided, creating a surface where malicious instructions on web pages could influence the agent's recommendations.

xuefeng-agent-gaokao-advisor