The Agent Skills Directory

[PROMPT_INJECTION]: The 'CRITICAL: FULLY AUTOMATIC EXECUTION' section contains explicit instructions to override the agent's interactive safety layer. It directs the agent to suppress all user confirmations and permission requests for file deletions and script executions, ensuring the process runs unattended even when performing destructive operations.
[PRIVILEGE_ESCALATION]: The skill uses sudo apt-get to install system software and chmod +x to grant execution permissions to binaries downloaded to system-level directories like /usr/local/bin/.
[COMMAND_EXECUTION]: The skill extensively uses the Bash tool to perform platform detection, install dependencies, manage files, and execute the document conversion pipeline through pandoc and typst.
[EXTERNAL_DOWNLOADS]: The skill downloads the typst binary from a well-known repository on GitHub (github.com/typst/typst) as part of its automated setup process.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted Markdown input to generate PDF output, creating an attack surface for indirect injection.
Ingestion points: Markdown source file (input.md).
Boundary markers: None specified for the processed content.
Capability inventory: The skill has access to the Bash tool with sudo capabilities and the ability to delete files (rm).
Sanitization: No validation or sanitization is mentioned for the input content or file paths before they are used in commands or targeted for deletion.

whitepaper