The Agent Skills Directory

[COMMAND_EXECUTION]: The skill frequently invokes system utilities to perform document conversions and repository management.
The following scripts use subprocess.run to call external tools: bib_to_entries.py (pandoc, typst), build.py (pandoc), canonicalize.py (pandoc), comments.py (gws), expand_citations.py (typst), make_redline.py (pandoc, pkill, soffice), provenance.py (git), and reconcile.py (git, pandoc).
These tools are standard for the skill's primary purpose of document translation and reconciliation.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process external, potentially untrusted documents which introduces an indirect injection attack surface.
Ingestion points: Untrusted data enters the system through external Word documents (.docx), BibTeX files (.bib), and Google Drive comments.
Boundary markers: The skill does not implement explicit delimiters or warnings to the AI agent to ignore instructions embedded within the converted text.
Capability inventory: The skill has the capability to write files and execute a variety of system commands including document compilers and version control tools.
Sanitization: While the scripts perform significant regex-based normalization for formatting and structural correctness, they do not specifically filter for malicious natural language instructions meant to influence an AI's behavior.
Risk: An attacker could embed instructions in a Word document's text or comments that, when converted to Typst and read by an AI agent, could attempt to override the agent's behavior.

docx-typst