The Agent Skills Directory

[DATA_EXFILTRATION]: The upload action within scripts/api.ts allows the agent to read local files using fs.readFileSync and upload the content to a remote server via a PUT request to a service URL. While designed for media publishing, this mechanism can be exploited to exfiltrate sensitive local files such as environment variables, SSH keys, or system configurations if a malicious path is provided to the tool.
[COMMAND_EXECUTION]: The skill's primary functionality is driven by a local TypeScript script (scripts/api.ts) that executes complex operations involving direct filesystem access and unverified network communications.
[PROMPT_INJECTION]: Documentation across the skill (e.g., SKILL.md and docs/publish/index.md) contains structured meta-instructions under 'Logic Flow' and 'Trigger' headers. These instructions are designed to override the agent's default reasoning and enforce a specific execution protocol, which could be used to steer the agent towards unsafe actions.
[DATA_EXFILTRATION]: The skill presents an attack surface for indirect prompt injection through its ingestion of external data. 1. Ingestion points: scripts/api.ts retrieves data from remote API endpoints via callApi (e.g., account lists, categories, records). 2. Boundary markers: Absent in the provided documentation and logic flows. 3. Capability inventory: scripts/api.ts provides tools for disk read and network upload. 4. Sanitization: Absent; the tool parses remote JSON responses and incorporates them directly into the agent's context.

yixiaoer