The Agent Skills Directory

[PROMPT_INJECTION]: The instructions explicitly command the agent to "AUTOMATICALLY execute the following steps WITHOUT asking for confirmation" and "DO NOT ask for user confirmation at each step," which overrides standard safety protocols and reduces user oversight for high-risk operations.
[REMOTE_CODE_EXECUTION]: In SKILL.md, the agent is instructed to "Create a Python script using PIL and reportlab libraries" and "Execute the script to generate the PDF." This dynamic code generation and execution at runtime is a high-risk activity that could be exploited.
[COMMAND_EXECUTION]: The skill utilizes shell commands including sips for image format conversion and brew install for system-level dependency management on macOS.
[EXTERNAL_DOWNLOADS]: The instructions require the agent to perform pip install for multiple libraries (pillow, reportlab, easyocr, etc.) from public registries, which introduces supply chain risks if packages are not properly reviewed.
[DATA_EXFILTRATION]: While no explicit exfiltration to a remote server was detected, the skill is designed to process extremely sensitive personal documents like bank certificates and passports. The automated extraction of this data into the agent's context and temporary files increases the risk surface for data exposure.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection from content within the processed images. \n
Ingestion points: OCR text extraction from user-provided images in SKILL.md. \n
Boundary markers: Absent; there are no delimiters or instructions to ignore commands within the extracted text. \n
Capability inventory: Shell command execution (sips, pip, brew) and dynamic Python execution defined in SKILL.md. \n
Sanitization: Absent; the skill processes all extracted text directly for translation and PDF inclusion.

visa-doc-translate