The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external Kingdee ERP responses (via ExecuteBillQuery), which presents an attack surface for indirect prompt injection if an attacker can control ERP field values.
Ingestion points: Data enters the agent's context through the output of openerp query and openerp objects as described in SKILL.md sections 3 and 5.
Boundary markers: The skill provides a negative constraint instructing the agent to treat material names/specifications as data rather than instructions, but it lacks structural delimiters or system-level enforcement of these boundaries.
Capability inventory: The agent has the capability to execute shell commands using the openerp CLI tool, which could be abused if malicious data is interpreted as instructions.
Sanitization: There is no evidence of programmatic sanitization; the skill relies on the LLM's adherence to instructional warnings.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill manages highly sensitive credentials required for ERP access, including appSecret and KDSVCSessionId (bearer tokens).
Sensitive file paths: Credentials and sessions are stored in ~/.config/openerp/config.json and ~/.config/openerp/session-*.json respectively.
Exposure risk: The configuration process described in SKILL.md (Section 0 and 1) involves passing secrets like --app-secret as command-line flags. This practice can expose sensitive data to other users on the system who can view the process list.
Mitigation: The skill correctly recommends setting file permissions to 0600 and advises against printing or exfiltrating these tokens, which helps mitigate risks associated with persistence and display.

openerp-shared