The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions direct the agent to execute typst --version in the local workspace to resolve the target compiler version. Additionally, the scripts/validate_version_support.py validation script uses subprocess.run to invoke local Typst binaries for automated testing of compatibility fixtures. These actions are consistent with the skill's primary function as a documentation and compilation aid.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection because it ingests untrusted content from user-provided Typst source files and structured data (JSON, YAML, TOML, etc.).
Ingestion points: SKILL.md identifies user-provided templates, imports, and assets as inputs.
Boundary markers: None are specified in the instructions to separate user content from agent logic.
Capability inventory: The skill is capable of executing shell commands (typst --version) and writing files (.typ source).
Sanitization: No explicit sanitization or escaping of external content is mentioned. While these factors represent a vulnerability surface, they are inherent to the skill's purpose, and no active exploitation or malicious patterns were detected.

typst-creator