The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses python3 to execute internal scripts such as workflow_context.py and context_json.py to manage task resumption and JSON parsing. It specifically instructs the agent to use proper shell quoting for arguments to prevent command injection, which is a positive security practice.
[INDIRECT_PROMPT_INJECTION]: The skill has a defined attack surface for indirect prompt injection as it ingests untrusted data from repository environments.
Ingestion points: Processes error logs, configuration files, source code, and browser DOM snapshots (SKILL.md).
Boundary markers: The skill suggests differentiating between task continuations and new candidates but lacks explicit delimiters or "ignore instructions" warnings when interpolating external code or logs into the prompt.
Capability inventory: Execution of Python scripts, file system reads via JSON pointers, and browser interaction capabilities.
Sanitization: While it mentions shell quoting for command line arguments, it does not specify sanitization or filtering for natural language instructions that might be embedded in the code comments or logs it analyzes.
[EXTERNAL_DOWNLOADS]: The skill mentions "restoring the full package installation" (恢复整包安装) if dependencies or resources are missing. While no specific URLs are provided in the skill manifest, this implies a mechanism for downloading external components.

code-writer