The Agent Skills Directory

[PROMPT_INJECTION]: The 'ACTION REQUIRED' section in SKILL.md instructs the agent to 'ACT: 进入"工作流"第一步并执行，不要停在确认状态' (Enter the first step of the workflow and execute, do not stop in a confirmation state). This is an attempt to override standard agent operating procedures and bypass user oversight.
[COMMAND_EXECUTION]: The skill documentation in references/sandbox-orchestration.md includes commands for administrative setup, such as 'sudo ./cape2.sh all', which requires elevated privileges to execute scripts sourced from an external repository.
[EXTERNAL_DOWNLOADS]: The skill references downloading and installing tools from various third-party GitHub repositories and registries, including 'git clone https://github.com/kevoreilly/CAPEv2', 'git clone https://github.com/AustralianSignalsDirectorate/azul', and 'pip install flare-floss'.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted malware samples which serve as a significant attack surface for indirect prompt injection.
Ingestion points: Processing of external binary samples and scripts via tools like 'strings', 'rabin2', 'floss', and 'dnSpy' as defined in SKILL.md.
Boundary markers: Absent; the instructions do not provide delimiters or warnings for the agent to ignore potentially malicious embedded instructions in the processed data.
Capability inventory: The agent is granted extensive capabilities including full shell command execution, file system writes, and network operations to various external APIs (VirusTotal, Sandbox APIs).
Sanitization: No evidence of output sanitization or validation for data extracted from analyzed samples before it is returned to the agent context.

malware-analysis