The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill presents an indirect prompt injection surface because it reads and processes external files, though the risk is negligible due to the absence of dangerous capabilities.
Ingestion points: Reads multiple local archive files from the {存档根目录}/sessions/{项目名}/ path during the file aggregation process.
Boundary markers: No explicit LLM boundary tags or instruction-exclusion delimiters are defined in the prompt generation phase, but the skill enforces rigorous structural validation ("段名逐字对") before accepting data.
Capability inventory: The skill is strictly limited to reading local archive markdown files and writing the aggregated report to a local folder Flat files structure (reports/{项目名}/). It contains no network access, shell command execution, or dynamic evaluation components.
Sanitization: Content is copied verbatim into structured Markdown sections without active sanitization, but instructions explicitly restrict processing to specific user-defined fields and inhibit any AI-driven interpretation or summarization ("不从对话里凭空补内容", "不发挥").
[SAFE]: File management and directory generation (mkdir -p) operations are restricted to specific local workspace paths (sessions/ and reports/), complying with normal local application scopes and least privilege principles.

xy-brief