The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/autocorrect.ts uses execSync to execute a shell command: npx autocorrect-node --fix "${filePath}". The filePath variable is passed directly from command-line arguments in scripts/main.ts and interpolated into the shell string without validation or escaping. This allows for command injection if a maliciously crafted file path (e.g., "; touch pwned; #.md") is passed to the script, potentially allowing an attacker to execute arbitrary shell commands.
[INDIRECT_PROMPT_INJECTION]: The skill's primary workflow involves reading, analyzing, and restructuring content from external files provided by the user (Steps 1, 2, 4, and 5).
Ingestion points: In Step 1: Read Source File, the agent reads untrusted data from a user-specified file path.
Boundary markers: Absent. The instructions do not provide delimiters or warnings to the agent to ignore instructions embedded within the user's text.
Capability inventory: The skill can execute shell commands via scripts/main.ts (using npx), write files to the local file system, and move/backup files using mv.
Sanitization: Absent. The content is processed directly by the agent to generate frontmatter, summaries, and formatting suggestions, which could lead to the agent following malicious instructions embedded in the source file.

baoyu-format-markdown