The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests and processes content from notes, audio transcripts, and external web pages, which could contain adversarial instructions.
Ingestion points: Data enters the agent context through read_note, read_blocks, read_section, get_audio_transcript, and import_web_page (documented in SKILL.md and API_REFERENCE.md).
Boundary markers: The skill uses semantic XML tags (e.g., <p>, <h1>) for structure, but lacks explicit instructions for the agent to ignore or delimit instructions embedded within these tags.
Capability inventory: The agent possesses significant write and management capabilities, including edit_block, batch_edit, create_note, and delete_note, which could be abused if an injection is successful.
Sanitization: There is no mention of content sanitization or instruction filtering for ingested data.
[DATA_EXFILTRATION]: The skill supports a file-referencing mechanism using the _file suffix (e.g., content_file, operations_file) that allows the underlying MCP server to read local file contents and insert them into notes. This feature, while intended for bypassing CLI argument length limits, could be exploited to read sensitive local files (like .ssh/config or .env) into the cloud-synced note application if the agent is misdirected to an unauthorized path.
[EXTERNAL_DOWNLOADS]: The skill performs network operations to fetch external content.
The import_web_page tool fetches content from a whitelist of domains, including WeChat Official Accounts, Zhihu, and Douban.
The insert_image tool fetches image data from arbitrary HTTP/HTTPS URLs or accepts base64 data URIs.

wps-note