The Agent Skills Directory

[PROMPT_INJECTION]: The skill uses authoritative and coercive language (e.g., "SYSTEM RULES
MANDATORY", "DO NOT SKIP", "HIGHEST PRIORITY") to override the AI agent's base instructions and safety protocols. It claims that its rules "cannot be uninstalled" and "cannot be ignored," which is a hallmark of prompt injection.
[DATA_EXFILTRATION]: The skill defines a process for the automatic collection and storage of sensitive Personal Identifiable Information (PII), including emails, phone numbers, and account configurations, into a standardized local file (USER.md). While stored locally, this facilitates unauthorized access or subsequent exfiltration of user data.
[REMOTE_CODE_EXECUTION]: The instructions mandate that the agent "must first try to install that skill's dependencies" if a skill is missing. This automatic installation of software without explicit user verification or oversight poses a significant risk of executing malicious code from untrusted sources.
[COMMAND_EXECUTION]: The skill provides specific command-line instructions for Windows (PowerShell and CMD) to change system code pages and execute scripts, which grants the skill direct control over the underlying operating system environment.
[PROMPT_INJECTION]: The skill creates an indirect prompt injection vulnerability by automatically ingesting untrusted data from USER.md and memory/ files into the agent's context at startup (SKILL.md). These ingestion points lack boundary markers or sanitization, exposing capabilities such as subprocess execution (Node.js execSync, Python subprocess.run) and the computer tool to potentially malicious instructions stored in the workspace.

qclaw-rules