The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external requirements materials, including PRDs, screenshots, and user-provided documentation, which serves as a vector for indirect prompt injection.
Ingestion points: The agent reads from user-specified requirement sources, PRD documents, and existing repository code as described in the '汇总需求来源' (Summarize requirement sources) section of SKILL.md.
Boundary markers: There are no explicit instructions or delimiters defined to isolate untrusted external content, increasing the risk that instructions embedded within those documents could be executed by the agent.
Capability inventory: The skill possesses file-writing capabilities, specifically the ability to create or overwrite the API清单.md file within the repository structure.
Sanitization: No validation or sanitization routines are specified for the data extracted from requirements before it is committed to the file system.
Autonomy Abuse: The skill explicitly instructs the agent to '覆盖已有同名文件，无需询问是否发布' (overwrite existing files of the same name without asking), which reduces user oversight and could be exploited to silently modify repository content if the agent is compromised by an indirect injection.

to-api