The Agent Skills Directory

[PROMPT_INJECTION]: The core functionality of the skill involves ingesting untrusted data (chat logs, emails, documents) and feeding it into LLM prompts to extract personality traits and work habits. This creates a surface for indirect prompt injection if the source materials contain malicious instructions designed to subvert the agent's behavior.
Ingestion points: Untrusted data enters via tools/feishu_auto_collector.py, tools/slack_auto_collector.py, tools/email_parser.py, and tools/dingtalk_auto_collector.py into the knowledge/ directory.
Boundary markers: The analysis prompts in prompts/work_analyzer.md and prompts/persona_analyzer.md use standard markdown separators but lack explicit instructions to ignore embedded commands within the interpolated source text.
Capability inventory: The meta-skill utilizes Bash, Read, Write, and Edit tools, which could be abused if an injection is successful.
Sanitization: The skill performs structural cleaning (e.g., removing HTML or system message markers) but does not sanitize the text for adversarial instructions.
[COMMAND_EXECUTION]: The skill relies on several external CLI tools executed via subprocesses:
tools/feishu_mcp_client.py executes npx -y feishu-mcp, which triggers the dynamic download and execution of a remote Node.js package.
tools/research/download_subtitles.sh and tools/research/transcribe_audio.py utilize yt-dlp to download content from arbitrary user-supplied URLs.
[CREDENTIALS_UNSAFE]: The setup scripts (--setup flags) prompt the user for high-privilege secrets, including Feishu App Secrets, Slack Bot Tokens, and DingTalk App Secrets. These are stored locally in the user's home directory (~/.colleague-skill/).
[EXTERNAL_DOWNLOADS]: The skill performs network operations to well-known cloud services (Slack, Feishu, DingTalk, and OpenAI) to collect data. While these are required for the skill's primary purpose, they involve the transmission of potentially sensitive organizational data.

dot-skill