The Agent Skills Directory

[PROMPT_INJECTION]: The skill's 'Post-write Review' and 'Todo Documents' workflows in SKILL.md instruct the agent to re-read and refine existing documentation to 'tighten the logic' and 're-read the full document'. This creates an indirect prompt injection vulnerability where malicious instructions embedded in project notes or imported data could influence the agent's behavior during the review phase.
Ingestion points: User-supplied text and existing documentation files processed in SKILL.md.
Boundary markers: None. The instructions encourage the agent to merge content into a seamless 'narrative' without delimiters.
Capability inventory: File system read/write access within the documentation root.
Sanitization: No input validation or escaping is performed on the content before the agent re-reads it.
[COMMAND_EXECUTION]: The skill maintains a 'Common Command Registry' (常用命令.txt) as defined in SKILL.md. It is designed to save, generate, and organize shell commands. If an attacker can influence the content through indirect injection or if a user inadvertently saves a malicious one-liner, the registry serves as a persistent storage for payloads intended for future execution by humans or other agents.
[DATA_EXFILTRATION]: The skill's 'Documentation Root' logic in SKILL.md permits the user to explicitly define paths (e.g., 写到 /path/to/repo/docs_product). This capability allows the agent to write files to arbitrary locations on the file system if not restricted by the underlying environment's security sandbox.

awesome-docs