The Agent Skills Directory

[DATA_EXFILTRATION]: The skill executes network requests to official Tencent Lexiang API domains (lxapi.lexiangla.com, lexiangla.com) and Tencent Cloud Object Storage (myqcloud.com). These communications are required for retrieving knowledge, managing teams, and uploading documents to the user's own enterprise instance and are directed solely to the vendor's infrastructure.
[COMMAND_EXECUTION]: The skill includes several automation scripts (scripts/init.sh, scripts/get_content.sh, scripts/upload_file.sh, scripts/md_to_page.py) to manage API workflows. These scripts are transparent, use standard system tools (curl, jq, python3), and do not download or execute untrusted code from remote sources.
[PROMPT_INJECTION]: The skill retrieves content from an external knowledge base to provide as context for the agent. This represents a standard indirect prompt injection surface common to all RAG (Retrieval-Augmented Generation) tools. The risk is considered low as the functionality is inherent to the skill's purpose, and it does not contain explicit instructions designed to bypass agent safety filters.
[SAFE]: Credential management is handled securely. The initialization script (scripts/init.sh) prompts users for their API keys and stores them in a local directory (~/.config/lexiang) using restricted file permissions (chmod 600), preventing unauthorized access by other local users.

lexiang