The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill documentation includes instructions that utilize root privileges, which could lead to unauthorized system modifications if executed by the agent.
Evidence: The file references/output-modes.md contains the command sudo tlmgr update --self && sudo tlmgr install collection-fontsrecommended for font management.
[COMMAND_EXECUTION]: The skill relies on a wide array of external command-line tools for processing documents, which increases the risk of command injection or exploitation if the tools have vulnerabilities or are used on malicious inputs.
Evidence: SKILL.md and references/sources.md specify the use of pdfinfo, pdftotext, pdftk, mutool, ebook-convert, pandoc, and ocrmypdf.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process large amounts of data from untrusted external sources (books and URLs), creating a vulnerability where embedded malicious instructions could influence agent behavior.
Ingestion points: The skill reads local PDF, EPUB, MOBI, TXT, and Markdown files, and fetches content from public-domain URLs as described in SKILL.md and references/sources.md.
Boundary markers: The instructions lack explicit delimiters or safety prompts to isolate the ingested text from the agent's control logic.
Capability inventory: The skill has extensive capabilities, including executing shell commands via conversion tools and writing files to the user's document directories (~/Documents/books/ and ${SECOND_BRAIN_VAULT}).
Sanitization: There is no evidence of text sanitization or safety filtering performed on the content extracted from external sources.
[EXTERNAL_DOWNLOADS]: The skill fetches content from external repositories and suggests the installation of several third-party software packages.
Evidence: The skill uses WebFetch to download texts from services like Project Gutenberg and Archive.org, and suggests installing pandoc, calibre, and ocrmypdf via brew in SKILL.md and references/sources.md.

read-book