The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The scripts/main.ts file contains a downloadFile function that uses the http and https modules to fetch images from arbitrary URLs found within the input Markdown content. These images are saved locally to a temporary directory during conversion.
[EXTERNAL_DOWNLOADS]: The syntax highlighting utility in scripts/md/utils/languages.ts is configured to fetch additional Highlight.js language definitions from a remote CDN at https://cdn-doocs.oss-cn-shenzhen.aliyuncs.com.
[COMMAND_EXECUTION]: The main entry point scripts/main.ts uses spawnSync to execute the rendering engine using npx -y bun. This facilitates the internal workflow of the skill but involves executing shell commands to manage its lifecycle.
[REMOTE_CODE_EXECUTION]: The file scripts/md/utils/languages.ts employs dynamic import() to load JavaScript modules from a remote URL constructed at runtime. While this is used for extending syntax highlighting capabilities, loading and executing code from a remote server presents a potential supply chain risk if the CDN is compromised.
[INDIRECT_PROMPT_INJECTION]: The skill acts as a processing engine for user-provided Markdown files. This represents an indirect prompt injection surface where maliciously crafted Markdown (e.g., exploiting specific rendering extensions or diagram parsers) could attempt to influence the agent's behavior or compromise the output integrity. The skill lacks explicit sanitization or boundary markers for the ingested content.

baoyu-markdown-to-html