The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run to execute local system utilities for document processing, such as pdftotext, pdfinfo, and Calibre's ebook-convert.
Evidence: Found in scripts/book_to_skill/parsers/pdf.py, scripts/book_to_skill/parsers/calibre.py, and scripts/book_to_skill/dependencies.py.
Mitigation: Input paths are validated against supported extensions and the code implements extensive filesystem security checks (e.g., O_NOFOLLOW, symlink verification) to prevent command injection or path traversal.
[EXTERNAL_DOWNLOADS]: The skill includes a dependency management system in scripts/book_to_skill/dependencies.py that can install required Python libraries (such as docling, pypdf, ebooklib) using pip.
Mitigation: This feature is disabled by default (mode is 'report'), requires explicit user opt-in ('yes' mode), and only targets well-known, pre-defined libraries listed in the configuration.
[INDIRECT_PROMPT_INJECTION]: The skill processes external, untrusted documents which may contain hidden instructions intended to influence agent behavior.
Ingestion points: Document content enters the system via scripts/extract_document.py (using resolve_input_files in scripts/book_to_skill/utils.py).
Boundary markers: Generated content is organized into structured Markdown files using templates from the assets/ directory, which provide implicit logical boundaries.
Capability inventory: The skill performs subprocess execution (scripts/book_to_skill/parsers/pdf.py, calibre.py), file writing (scripts/extract_document.py, scripts/skill_plugin_emitter.py), and optional package installation (scripts/book_to_skill/dependencies.py).
Sanitization: Robust sanitization is present; scripts/book_to_skill/sanitize.py filters invisible Unicode/bidi controls, scripts/book_to_skill/zip_safety.py prevents XXE/Zip Bombs, and scripts/book_skill_validator.py provides post-generation validation against common injection patterns.

book-to-skill