The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted external materials (素材, 经历, 资料) to generate long-form HTML content without providing boundary markers or instructions to sanitize embedded instructions. This creates a surface where malicious instructions in the input could influence the agent's behavior.
Ingestion points: Processes external content provided by the user in the initial prompt or as follow-up materials.
Boundary markers: Absent. There are no delimiters or specific warnings to ignore instructions within the processed data.
Capability inventory: Writing files to the local filesystem and executing shell commands via the 'open' utility.
Sanitization: Absent. No filtering or escaping mechanisms are mentioned for the external content before it is interpolated into the HTML output.
[COMMAND_EXECUTION]: The skill instructs the agent to execute the shell command 'open ' using a file path constructed from a user-influenced 'content theme' ([内容主题]). A malicious input could include shell metacharacters (e.g., semicolons or backticks) to achieve command injection when the agent attempts to open the file.
[DYNAMIC_EXECUTION]: The skill generates HTML files from potentially untrusted external content and automatically opens them in the user's browser. If the source materials contain malicious scripts, they could execute in the browser's context, potentially leading to local file access or session theft.

readable-output