The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes content from untrusted external XMind files (via content.json or content.xml inside ZIP archives).
Ingestion points: Node titles, notes, labels, and links are extracted from user-provided files in scripts/xmind_tool.py and converted to Markdown.
Boundary markers: The agent instructions do not explicitly mandate delimiters or provide warnings to disregard instructions that might be embedded within the思维导图 content.
Capability inventory: The skill possesses the ability to read and write to the local filesystem and execute shell commands via the helper script.
Sanitization: The script performs structural parsing but does not sanitize the text content of nodes before presenting it to the agent.
[COMMAND_EXECUTION]: The skill executes a local Python helper script using shell commands. The script takes user-supplied or context-derived inputs (session ID, file paths) as arguments.
Evidence: python skills/xmind/scripts/xmind_tool.py --session <session-id> <command> [args...] in SKILL.md.
Mitigation: The script uses Python's os.path and zipfile libraries for file operations rather than passing these arguments back to a shell, which significantly reduces command injection risk.
[DATA_EXFILTRATION]: The skill stores session memory in the system's temporary directory.
Evidence: get_memory_dir in scripts/xmind_tool.py uses os.path.join(tempfile.gettempdir(), 'skills-xmind-parsed', session_id).
Risk: In shared or multi-user environments, data written to /tmp may be readable by other users if the directory permissions are not sufficiently restrictive, potentially exposing the contents of parsed XMind files.

xmind