The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to install several external extensions (skills) from various GitHub repositories if they are not already present. While some references are to known organizations, others originate from unverified individual user accounts (e.g., lucifer1004/claude-skill-typst, apcamargo/typst-skills, softaworks/agent-toolkit, wondelai/skills, benjaminwestern/google-engineer-skills). This creates a supply chain risk where the agent's execution environment could be compromised by unvetted third-party code.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and synthesize user-supplied data such as project glossaries, conversation histories, and investigation write-ups into Typst reports and D2 diagrams. It lacks specific guidance for sanitizing this input or using strict boundary markers when interpolating untrusted data into the Typst/D2 source code, which could lead to formatting manipulation or exploitation of the underlying compilers.
Ingestion points: Conversation history, project glossaries, ADRs, and existing investigation write-ups summarized in the workflow (SKILL.md).
Boundary markers: No explicit delimiters or instructions are provided to the agent to escape or isolate user content within the generated markup files.
Capability inventory: Shell execution of typst compile, d2 compile, and various npx skills add commands.
Sanitization: No sanitization or validation logic is defined for the content synthesized from user inputs before it is compiled.

technical-pdf