The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs users to install an external component from an unverified GitHub repository (github.com/cat-xierluo/legal-skills). It then executes a script (convert.js) from that installation using subprocess.run and osascript. This creates a pathway for executing unverified code on the host system.
[COMMAND_EXECUTION]: The script scripts/law_to_markdown.py uses subprocess.run to execute /usr/bin/osascript. It targets a script file at a computed path in the user's home or current directory, which could be exploited if the directory contents are manipulated by a third party.
[EXTERNAL_DOWNLOADS]: Instructions in SKILL.md and scripts/law_to_markdown.py prompt the user to download and install external code from a third-party GitHub repository. This behavior introduces supply chain risks as the code is not vetted or managed through a standard, secure package registry.
[PROMPT_INJECTION]: The skill processes untrusted documents (.pdf, .docx, .txt) to generate Markdown. It lacks boundary markers and sanitization steps, making it vulnerable to indirect prompt injection where malicious instructions hidden in a document could influence the AI agent's subsequent behavior when it reads the converted output.
Ingestion points: Input file read in scripts/law_to_markdown.py.
Boundary markers: None identified in scripts.
Capability inventory: File writing and shell command execution (subprocess.run).
Sanitization: Not implemented; processes raw text with regex.

law-to-markdown