The Agent Skills Directory

[DATA_EXFILTRATION]: The create_xmind.mjs script includes an attachment feature that allows topics to embed files from the local file system. The script uses readFile(resolve(att.sourcePath)) to read content without any path sanitization or restriction. This provides a mechanism for an agent to be manipulated into reading and exfiltrating sensitive files (such as SSH keys or credentials) by embedding them into a .xmind archive.
[REMOTE_CODE_EXECUTION]: The SKILL.md file provides a fallback Python script for processing large PDF files that executes subprocess.run(['pip', 'install', 'pymupdf']). Instructing an agent to perform dynamic package installation at runtime via shell execution bypasses standard dependency management and introduces risks associated with untrusted remote code.
[COMMAND_EXECUTION]: The skill relies on piping data to Node.js scripts and executing shell commands for PDF processing (pdftotext). This reliance on shell-level integration for core functionality increases the risk of command injection if filenames or paths are provided as unvalidated input.
[DYNAMIC_EXECUTION]: The recommended PDF extraction snippet uses importlib.import_module('fitz') to load a library after installing it via pip. This pattern of runtime environment modification and dynamic loading of code is a significant security concern.
[INDIRECT_PROMPT_INJECTION]: The skill's primary purpose is to parse and analyze external .xmind files through read_xmind.mjs. Because the skill summarizes and acts upon the content of these files, it is vulnerable to indirect prompt injection where malicious instructions embedded in a mind map topic could override agent behavior during analysis.
Ingestion points: read_xmind.mjs parses ZIP archives containing JSON and XML content from user-provided file paths.
Boundary markers: The parsing logic lacks delimiters or instructions to ignore embedded commands within the mind map nodes.
Capability inventory: The skill has file system write access, arbitrary file read access (via the attachment mechanism), and shell command execution capabilities.
Sanitization: The custom XML parser in read_xmind.mjs performs entity decoding but does not sanitize or escape the content for safe downstream processing by the agent.

xmind