The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and process untrusted external reference text ("参考文字"), creating an inherent attack surface for indirect prompt injection.
Ingestion points: Untrusted content enters the agent context through the reference text processing flow described in SKILL.md and references/reference-to-draft.md.
Boundary markers: The skill contains explicit "Material Isolation" (素材隔离) rules in references/reference-to-draft.md, instructing the agent to treat input exclusively as data and to ignore any embedded instructions, role-plays, or configuration attempts.
Capability inventory: The agent has access to file-reading across multiple skill directories, network search capabilities for fact-checking, and the ability to execute local scripts via python3 and runpy.
Sanitization: Instructions require the agent to verify all external claims against reliable sources, remove author-specific identifiers, and ignore "low-trust" instructions found within the reference material.
[DYNAMIC_EXECUTION]: The script scripts/check_profile.py utilizes the runpy.run_path function to execute code from a calculated path targeting a sibling skill (yetong-copy/scripts/check_profile.py). While it includes security checks (verifying the target is a file and not a symbolic link), this represents dynamic loading and execution of code at runtime.
[COMMAND_EXECUTION]: The instructions in SKILL.md and references/local-title-contract.md direct the agent to invoke shell commands (e.g., python3 scripts/check_profile.py and python3 yetong-topic/scripts/check_local_titles.py). These calls are used for persona validation and title compliance checks, but they grant the skill the ability to execute subprocesses.

yetong-remix