The Agent Skills Directory

[PROMPT_INJECTION]: The skill uses high-pressure framing and override markers to control agent behavior across all stages.
Evidence: Found in SKILL.md and all agent prompts in references/prompts/ (e.g., 01-topic-scout.md, 02-researcher.md).
Patterns: Use of '⚠️ 铁律 (CRITICAL RULES)', '必须 100% 遵守' (Must follow 100%), and '🚫 绝对禁止' (Absolutely Prohibited) to override default model decision-making regarding workflow progression.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process large amounts of untrusted external data.
Ingestion points: references/prompts/02-researcher.md instructs the agent to perform web_search and web_fetch to collect 'User Feedback' from platforms like Weibo, Zhihu, Reddit, and Twitter/X.
Boundary markers: Absent. The prompts do not specify the use of delimiters or 'ignore embedded instructions' warnings when handling collected social media content.
Capability inventory: The skill has the ability to write to the local filesystem (workflow/ and archive/ directories), execute local Python scripts (scripts/*.py), and perform network operations via requests.
Sanitization: Absent. There is no instruction to sanitize or filter the content retrieved from external sources before passing it to subsequent agents (Strategist, Writers, etc.).
[COMMAND_EXECUTION]: The workflow relies on executing local Python scripts to perform image operations.
Evidence: references/prompts/07-illustrator.md instructs the agent to run commands like python3 scripts/image_get.py "..." and python3 scripts/image_generate.py "...".
Risk: If an agent is compromised via indirect prompt injection, these command-line interfaces could be abused to execute arbitrary parameters or perform unintended network actions.
[EXTERNAL_DOWNLOADS]: The skill includes a dedicated script for downloading content from remote URLs.
Evidence: scripts/image_download.py uses the requests library to perform GET requests on URLs provided as command-line arguments and saves the results as .png files.
Context: This is a core feature for the 'Illustrator' stage, but it lacks a whitelist of allowed domains, allowing downloads from any source determined by the agent.

media-writer