The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/scan_drive.py script executes the aliyunpan CLI tool using the subprocess.run method. This is used to perform read-only directory listings (ll) across the cloud drive. The command is invoked using a list of arguments rather than a shell string, which is a recommended security practice to prevent command injection.
[EXTERNAL_DOWNLOADS]: The skill documentation instructs users to install the aliyunpan command-line utility, typically via the Homebrew package manager. This is a legitimate external dependency required for the skill to interact with the cloud provider's API.
[PROMPT_INJECTION]: The skill ingests and parses file and directory names directly from the user's cloud drive. This presents an indirect prompt injection surface; if an attacker can control names within a drive the agent is instructed to scan, they could potentially embed instructions aimed at influencing the agent's subsequent logic or output.

soia-pkm-alipan