The Agent Skills Directory

[DATA_EXFILTRATION]: The bundled scripts/flow2api-cli script contains a file_to_data_url function that reads arbitrary local files (e.g., using expanduser().resolve()) and encodes them as base64 for transmission to a remote API. This can be exploited to exfiltrate sensitive files like SSH keys or environment variables if the input JSON is controlled by a malicious prompt or indirect injection.
[COMMAND_EXECUTION]: The CLI script provides functionality via download_urls and save_binary_output to write data to an arbitrary output_path specified in the input. This allows for the overwriting of sensitive system or project files, which could lead to code execution or system instability.
[PROMPT_INJECTION]: The instructions in SKILL.md and UPDATE.md create a high-risk workflow where the agent is told to enter an 'Update Mode'. In this mode, the agent reads external code and documentation from a flow2api/ directory to modify the local CLI script. This is a significant surface for indirect prompt injection, where malicious content in those external files could trick the agent into adding backdoors to the skill.
[DYNAMIC_EXECUTION]: The skill explicitly encourages the agent to 'extend the CLI first' and 'update the CLI first' when changes are detected. This pattern of self-modifying code is dangerous as it allows the agent to evolve its capabilities in ways that may bypass initial security reviews and establish persistence for malicious logic.

xiaobao-flow2api