The Agent Skills Directory

[PROMPT_INJECTION]: The skill includes instructions in SKILL.md and references/chapter-extraction.md that explicitly coach the agent to bypass safety filters when processing themes of "violence, revenge, betrayal, and dark ethics." The agent is told that these are standard fictional elements and that refusing to analyze them would result in incomplete work, effectively instructing the agent to override its standard safety guidelines for this task.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted novel content supplied by users, creating a surface for injection attacks.
Ingestion points: Novel text files are read and processed from the 输入/ directory as described in SKILL.md.
Boundary markers: Absent. The skill does not implement specific delimiters or "ignore previous instructions" markers to isolate the untrusted novel content during ingestion.
Capability inventory: The skill executes shell commands to run Python scripts (novel_index.py, selftest.py) and relies on project tools (project_tool.py) to manage artifacts.
Sanitization: Absent. Novel content is summarized and analyzed by the agent without robust input validation or escaping mechanisms to prevent malicious embedded instructions from influencing agent behavior.
[COMMAND_EXECUTION]: The skill workflow relies on the execution of local Python scripts provided in the skill package (scripts/novel_index.py and scripts/selftest.py). While the scripts themselves appear to be legitimate parsing and testing utilities, the model's instruction to execute code in an environment where untrusted user data is processed increases the risk profile.

short-drama-novel-analyze