The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and summarize untrusted data from external sources, which is a standard surface for indirect prompt injection attacks.
Ingestion points: The skill uses WebSearch and WebFetch in Task 1 through Task 4 to retrieve news and regulatory data. Task 4 specifically uses a scraper to ingest social media content from platforms like Xueqiu.
Boundary markers: The instructions for the subagents do not include explicit structural delimiters (like XML tags or markdown dividers) or specific instructions to ignore embedded commands within the fetched content. While it mentions the CLAUDE.md objectivity principle, this is not a robust defense against adversarial injection.
Capability inventory: The skill possesses significant capabilities, including web searching, fetching external pages, writing files to the local workspace (reports/ directory), and executing local shell commands via Python scripts.
Sanitization: There is no evidence of sanitization or filtering of the external data before it is presented to the LLM for processing.
[COMMAND_EXECUTION]: The skill relies on executing local shell commands to perform scraping and financial calculations.
Evidence: The skill calls python3 tools/financial_rigor.py and python3 tools/xueqiu_scraper.py.
Injection Risk: The instructions specify passing user-provided variables like {公司名} (Company Name) and {股票代码} (Stock Code) directly into shell command arguments (e.g., python3 tools/xueqiu_scraper.py --user-id 1247347556 --keywords {公司名},{股票代码} --output /tmp/dyp-{公司名}.md). If the platform or the underlying tool-calling mechanism does not properly escape these variables, a malicious user could provide a company name containing shell metacharacters to execute arbitrary commands.

news-pulse