The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill generates a JavaScript file (scripts/usdm-md-to-docx.js) based on user-provided Markdown content and executes it using the node environment. This script is created dynamically to handle document structure, metadata, and requirement hierarchies.
[INDIRECT_PROMPT_INJECTION]: The skill processes external, potentially untrusted Markdown files and extracts metadata and requirement text. This data is then interpolated into a generated JavaScript script and shell commands without explicit sanitization instructions.
Ingestion points: User-supplied Markdown requirements documents (processed in Step 1).
Boundary markers: None explicitly defined to separate untrusted data from the generated code or shell commands.
Capability inventory: Execution of arbitrary JavaScript via node (Step 4), and execution of shell commands including unzip, xmllint, grep, and soffice (Step 5).
Sanitization: No specific sanitization or escaping mechanisms are described for handling metadata fields (like Document ID) or requirement text before they are used in script generation or shell execution.
[COMMAND_EXECUTION]: The skill instructs the agent to run several shell commands (unzip, xmllint, grep, and soffice) for document verification. These commands utilize filenames and paths derived from metadata extracted from the input Markdown document, which could lead to command injection if metadata fields are not properly validated.

requirements-docx