The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill extracts information from user-specified directories to populate navigation and configuration files like SOURCE_OF_TRUTH.md, AGENTS.md, and CLAUDE.md. This behavior can lead to indirect prompt injection if malicious data in the target folders influences the instructions that guide the agent's future behavior. Evidence Chain: (1) Ingestion points: User-provided directories and their file metadata/contents, as described in SKILL.md under the '只读审计' section. (2) Boundary markers: The instructions lack specific guidance on using delimiters or 'ignore' instructions when interpolating external summaries into configuration files. (3) Capability inventory: The skill involves extensive file system operations including reading, writing, and moving files. (4) Sanitization: No explicit sanitization or validation of the data extracted from user folders is mentioned.
[COMMAND_EXECUTION]: The skill performs active file management tasks, such as copying and moving files within the local environment. While these are necessary for the knowledge base organizational features, they constitute significant file system interaction capabilities.

xy-vault