The Agent Skills Directory

[COMMAND_EXECUTION]: The build-agreement.js script executes the pandoc command-line utility via spawnSync. While it uses structured arguments for input/output paths, the content of the input Markdown file is a document partially composed of user-provided strings from a JSON specification.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from spec.json and interpolates it into a Markdown template. While schedule rows are encoded to prevent Markdown syntax injection, other fields like legal, juris, and addr are inserted using direct string replacement. This allows for the injection of malicious Markdown or Pandoc directives into the document conversion process.
Ingestion points: spec.json (processed in scripts/build-agreement.js)
Boundary markers: None; fields are directly interpolated into the template.
Capability inventory: File system writes (fs.writeFileSync), file deletion (fs.rmSync), and external command execution (spawnSync('pandoc')).
Sanitization: The script validates spec.file for filename portability and encodes schedule cells using HTML entities, but lacks sanitization for primary template placeholders.
[DATA_EXPOSURE]: As explicitly noted in the documentation, Pandoc can read local or remote resources. An attacker could use indirect prompt injection to insert Pandoc directives that read sensitive local files and include their content in the generated DOCX output.

master-agreement-generator