The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted external data that can influence agent behavior and lead to information disclosure.
Ingestion points: The agent is instructed to read and process index.json and the subsequent book and weight files (e.g., books_*.jsonl, lookUpTable_*.csv) referenced within it.
Boundary markers: There are no explicit instructions or boundary markers provided to the agent to treat the contents of these data files as untrusted or to ignore any embedded instructions or malicious paths.
Capability inventory: The provided validation script scripts/check_books_package.py reads files and outputs findings; specifically, its error handling mechanisms (such as parse_int) can echo literal string content from the files into its output summary.
Sanitization: The script uses Path.resolve() for path handling but lacks directory sandboxing or path validation. This allows a malicious index.json to point to sensitive system files (e.g., using ../ syntax), which the script will then attempt to read and potentially leak via error messages.
[EXTERNAL_DOWNLOADS]: The skill requires a specific external dependency for certain file operations.
Evidence: The script scripts/check_books_package.py attempts to dynamically import the zstandard Python package to handle compressed .zst files. This is a well-known and standard library for Zstandard compression.
[COMMAND_EXECUTION]: The skill provides and encourages the execution of a local Python script to perform its primary function.
Evidence: SKILL.md provides explicit command templates for running python3 scripts/check_books_package.py with user-supplied path arguments.

book-generator