The Agent Skills Directory

[COMMAND_EXECUTION]: The SKILL.md file instructs the agent to execute a local Python script (scripts/search_liqi.py) using shell commands. This involves passing user-derived queries as arguments to the script, which could lead to command injection if the script does not properly sanitize its inputs.
[EXTERNAL_DOWNLOADS]: Automated security scans identified multiple malicious or blacklisted URLs within the reference interview files. These links pose a threat to users who might follow them and to the agent if it attempts to fetch their content. Notable findings include:
https://qcdesigners.com/index.php/forums/topic/2/new-to-quartz-composer-start-he found in references/interviews/full/duanxianzhou.md.
https://tech2do.net/%E4%BE%BF%E6%90%BA%E9%9F%B3%E6%BA%90%E4%B9%8Bipod%EF%BC%9A%E4%BB%8E%E5%85%A5%E9%97%A8%E5%88%B0%E5%8F%91%E7%83%A7/ found in references/interviews/full/dongzhi.md.
https://imaginationinternationalinc.com/copic/store/products/mlspsr/ found in references/interviews/full/shine.md.
[PROMPT_INJECTION]: The skill possesses a high surface area for Indirect Prompt Injection (Category 8) due to its architecture of reading hundreds of external markdown files containing user-generated interview responses.
Ingestion points: The agent reads data from references/interviews/full/*.md after search results are returned.
Boundary markers: The system lacks explicit delimiters or instructions to ignore potential commands embedded within the interview text.
Capability inventory: The agent can execute shell commands (search scripts) and read/write local files, increasing the impact of a successful injection.
Sanitization: There is no validation or filtering performed on the interview text to strip malicious instructions.

liqi-tools