The Agent Skills Directory

[COMMAND_EXECUTION]: In scripts/autocorrect.ts, the applyAutocorrect function uses execSync to run a shell command where the filePath variable is interpolated directly. This allows an attacker to execute arbitrary shell commands by providing a filename containing shell metacharacters (e.g., ;, &, or backticks).
Evidence: execSync(npx autocorrect-node --fix "${filePath}", { stdio: "inherit" }); in scripts/autocorrect.ts.
[COMMAND_EXECUTION]: The workflow instructions in SKILL.md (Step 6 and Step 7) direct the agent to run bash commands for file backups and script execution that interpolate {filename} and {output-file-path} variables. A maliciously named file could trigger arbitrary command execution when the agent follows these steps.
Evidence: mv "{filename}-formatted.md" "{filename}-formatted.backup-$(date +%Y%m%d-%H%M%S).md" and npx -y bun ${SKILL_DIR}/scripts/main.ts {output-file-path} [options] in SKILL.md.
[REMOTE_CODE_EXECUTION]: The skill relies on npx to download and execute autocorrect-node and bun at runtime. Running remote code without fixed versioning or integrity checks exposes the system to supply chain attacks and potential execution of malicious third-party code.
Evidence: npx autocorrect-node in scripts/autocorrect.ts and npx -y bun in SKILL.md.
[REMOTE_CODE_EXECUTION]: The scripts/package.json file lists several dependencies, including remark-cjk-friendly, which is notably absent from the scripts/bun.lock lockfile. This discrepancy means the version of the package installed at runtime is not cryptographically pinned, increasing the risk of inconsistent or malicious dependency resolution.
[PROMPT_INJECTION]: The skill processes untrusted user-provided files to generate summaries and titles, creating a surface for indirect prompt injection.
Ingestion points: User-specified markdown or plain text files processed in Step 1.
Boundary markers: No delimiters or warnings are used to prevent the agent from following instructions embedded in the source file.
Capability inventory: Subprocess execution via execSync, file system operations (readFileSync, writeFileSync, mv), and execution of network-capable tools (npx).
Sanitization: No input validation or path sanitization is performed on filenames or file content before they are used in sensitive operations.

baoyu-format-markdown