The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructions use authoritative and aggressive language to override agent behavior, claiming 'highest priority' (最高优先级), 'mandatory execution' (强制执行), and 'unconditional compliance' (无条件遵守). It explicitly commands the AI to ignore conflicts with other skills and treat deviations as system errors.
[CREDENTIALS_UNSAFE]: The 'User Information Auto-memory' feature mandates the automatic collection of PII, including email addresses, phone numbers, and service configurations, storing them in a persistent file (USER.md). While it cautions against storing passwords, the automated harvesting and centralized storage of PII creates a high-value target for unauthorized access or exfiltration.
[COMMAND_EXECUTION]: The instructions direct the agent to automatically 'install dependencies' for missing skills without manual review. This behavior could lead to the execution of arbitrary installation scripts or the introduction of malicious packages during the automated repair process.
[INDIRECT_PROMPT_INJECTION]: The automatic memory persistence mechanism creates a vulnerability surface where instructions or malicious data embedded in processed content (like emails or web pages) could be unintentionally harvested and stored in the long-term USER.md file, potentially poisoning future context or triggering unintended agent actions.
Ingestion points: Conversation history and external data processed during tasks (e.g., scraping, email handling).
Boundary markers: No specific boundary markers or isolation protocols are defined for the information being appended to USER.md.
Capability inventory: The skill possesses file-write capabilities (USER.md, memory/) and command-line execution (package installation, shell commands).
Sanitization: There is no explicit requirement to sanitize or validate the data before it is persisted to the long-term memory file.

qclaw-rules