The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions in SKILL.md direct the agent to execute a local script scripts/atoms-search.py using a shell command. The agent is instructed to use the pattern python3 <本 skill 目录>/scripts/atoms-search.py "<关键词>" to retrieve information.
[INDIRECT_PROMPT_INJECTION]: There is a potential command injection vulnerability in the search functionality. The agent constructs search queries based on "user's original words," which are then interpolated into a shell command. If a user provides input containing shell metacharacters (e.g., ;, &, or backticks) and the agent does not sanitize the resulting keyword, it could lead to arbitrary command execution on the host environment.
Ingestion points: User input regarding their business status and questions is processed in SKILL.md to form search queries.
Boundary markers: The instructions suggest wrapping the keyword in double quotes, but do not provide explicit sanitization rules for the agent to follow when constructing the command.
Capability inventory: The agent has the capability to execute shell commands via the python3 call specified in the instructions.
Sanitization: No explicit sanitization logic for the shell command arguments is present in the skill's instructions.
[DYNAMIC_EXECUTION]: The scripts/atoms-search.py script is used to dynamically query a local JSONL file or a remote vendor API (api.xyskill.xyz) based on runtime parameters. While the script itself uses standard libraries and avoids eval() or exec(), its invocation depends on untrusted user data flowing through the agent's prompt.
[DATA_EXPOSURE]: The search script scripts/atoms-search.py probes the user's filesystem for configuration and skill directories (e.g., ~/.xy/config.json, ~/.claude/skills/xy, ~/.kimi-code/skills/xy) to locate its internal database. While this is intended for locating the skill's own knowledge base, it involves environment fingerprinting.

xy-newbie