The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection. It processes untrusted conversation history into a summary and interpolates that summary directly into a shell command for execution. An attacker could craft conversation content that, when summarized, contains shell metacharacters (e.g., ;, &, or backticks) to execute unauthorized commands on the host. \n
Ingestion points: The '总结对话' (Summarize conversation) step in SKILL.md processes the current conversation history as input. \n
Boundary markers: The skill lacks delimiters or explicit instructions to ignore potentially malicious commands embedded within the conversation text. \n
Capability inventory: The skill utilizes node via a shell command to execute the send.js script with summary parameters. \n
Sanitization: There is no evidence of sanitization, escaping, or validation of the summary text before it is interpolated into the shell command string. \n- [COMMAND_EXECUTION]: The skill relies on the execution of a local Node.js script using shell commands. This capability, combined with untrusted input from dialogue summaries, creates a significant attack surface for command injection if the agent's shell execution environment does not handle quoting and escaping securely. \n- [DATA_EXFILTRATION]: The send.js script transmits conversation summaries to an external Feishu webhook URL. While intended for legitimate notifications, the destination is configurable (via config.json or by following the instructions in 配置SOP.md), which could be abused to send sensitive dialogue data to an arbitrary, attacker-controlled endpoint.

tell-me