The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The SKILL.md file contains a dynamic context injection block (!command) that executes shell commands whenever the skill is loaded by the agent. The command attempts to locate and execute a skill-toc binary from the skill directory or a specific plugin path in the user's home directory ($HOME/.claude/skills/plugin-utils/bin/skill-toc) to render a table of contents.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process content from external sources such as Word manuscripts (.docx), BibTeX files (.bib), and Google Drive comments. This external data is subsequently processed by the agent, which could lead to indirect prompt injection if the content contains adversarial instructions intended to influence the agent's behavior.
Ingestion points: Document content and metadata are read in scripts/canonicalize.py, scripts/reconcile.py, scripts/comments.py, and scripts/bib_to_entries.py.
Capability inventory: The skill has extensive access to the local shell, executing pandoc, typst, git, and soffice (LibreOffice).
Boundary markers: There are no specific isolation delimiters or instructions to the agent to disregard embedded natural language commands within the manuscript prose.
Sanitization: Content is normalized for formatting fixed points but is not sanitized or filtered for natural language instructions.
[COMMAND_EXECUTION]: Almost all included Python scripts (bib_to_entries.py, build.py, canonicalize.py, comments.py, expand_citations.py, make_redline.py, provenance.py, reconcile.py) utilize subprocess.run to execute external system binaries. This includes heavy reliance on pandoc and typst for document processing, git for version control integration and reconciliation, and LibreOffice (soffice) for redline generation. This represent a significant execution footprint that could be leveraged for malicious purposes if manipulated.
[DYNAMIC_EXECUTION]: The scripts bib_to_entries.py and expand_citations.py use typst eval to query and process document data. This involves executing Typst code and parsing the resulting JSON output, which constitutes runtime dynamic execution based on document content.

docx-typst