The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using the markitdown utility (e.g., python3 -m markitdown {{DOCUMENT_PATH}}). This presents a command injection surface if the DOCUMENT_PATH variable, which originates from user input or file system discovery, is not properly sanitized for shell metacharacters.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted documents and external web sources, making it vulnerable to indirect prompt injection attacks where malicious content in the source material could manipulate the subagent's judgment or the main agent's actions.
Ingestion points: The system ingests external data through the DOCUMENT_PATH and SOURCE_LOCATIONS variables defined in SKILL.md and references/subagent-prompt.md.
Boundary markers: The subagent prompt uses Markdown headers (## Document, ## Source(s)) to separate sections, but it lacks explicit boundary markers or instructions to ignore control sequences or embedded commands within the ingested content.
Capability inventory: The agent possesses capabilities for file reading/writing, web fetching via curl or similar tools, and subprocess execution via the markitdown command.
Sanitization: There is no mention of sanitization, filtering, or validation of the document text or source content before it is processed by the LLM.
[EXTERNAL_DOWNLOADS]: The skill recommends the installation and use of the markitdown package from Microsoft's official GitHub repository to facilitate text extraction from various document formats.

fact-check-loop