The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill explicitly instructs the agent to ask the user for their Tencent Cloud IM SecretKey and SDKAppID. While the skill includes steps to clear the key from temporary storage after use, the initial collection and processing of raw sensitive secrets by an AI agent is a high-risk pattern.
Evidence: Found in references/02-path-a-questions.md (Q.1) and references/02-path-a-script.md (A.3.0.2).
[DYNAMIC_EXECUTION]: The skill uses a delegation mechanism in tools/_delegate.py to dynamically load and execute Python modules from a sibling directory (../../trtc/tools/) using importlib.util. This allows the skill to execute code that is not resident in its own directory structure.
Evidence: Utilized by shims in the tools/ directory, including kb.py, flow.py, session.py, and reporting.py.
[EXTERNAL_DOWNLOADS]: The skill utilizes npx degit to fetch and extract project templates from a remote repository during the scaffolding phase.
Evidence: references/02-path-a-scaffold-template.md executes npx --yes degit vitejs/vite/packages/create-vite/template-vue-ts --force, targeting a well-known repository on GitHub.
[COMMAND_EXECUTION]: The skill's test suite performs shell command execution to verify tool behavior.
Evidence: tests/test_chat_bundle_contract.py uses subprocess.run to execute internal Python CLI tools.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from web searches and fetches, creating a significant attack surface for indirect prompt injection. It has the capability to write to the local filesystem and execute commands based on these inputs.
Ingestion points: User-provided "natural language" descriptions and documentation retrieved via web_fetch in references/14-official-docs.md.
Boundary markers: While it utilizes specific fields in .docs-query.yaml to store prompts and answers, it lacks robust delimiter enforcement for external documentation content.
Capability inventory: The agent can write files (write_to_file), manage sessions, and execute shell commands.
Sanitization: There is no evidence of specific sanitization or filtering logic applied to external content before it is processed by the LLM.

trtc-chat