The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its ingestion of content from local files that may contain untrusted data from external sources.
Ingestion points: The skill reads files from /Users/ugreen/Documents/obsidian/00 收件箱/ (Inbox) and /Users/ugreen/Documents/obsidian/选题库/待写选题.md (Topic Library), which are common entry points for external content.
Boundary markers: Absent; there are no instructions provided to the agent to treat data from these files as potentially untrusted or to isolate it from the system prompt directives.
Capability inventory: The skill possesses the ability to read arbitrary files within the vault, interact with the user via AskQuestion, and chain execution to the topic-agent skill.
Sanitization: No filtering, validation, or escaping of the ingested file content is performed before the data is integrated into the agent's context.

start-work