The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/md-to-word.cjs is vulnerable to shell command injection. It uses child_process.execSync to run npx svgexport with paths extracted from markdown content via regular expressions (svgPattern and htmlImgSvgPattern). These paths are not sanitized, allowing an attacker to escape the shell command using metacharacters and execute arbitrary code. Similar injection points exist in the handling of CLI arguments for output paths and image directories.\n- [REMOTE_CODE_EXECUTION]: The skill utilizes npx to dynamically download and execute the mmdc and svgexport packages from the npm registry at runtime. This introduces a risk of executing malicious code from remote sources.\n- [EXTERNAL_DOWNLOADS]: The skill's workflow relies on several external tools and packages without integrity verification or version pinning, increasing the risk of supply chain vulnerabilities.\n- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection. It processes untrusted markdown content that can contain payloads designed to exploit the command injection vulnerabilities in the conversion script.\n
Ingestion points: Markdown source files read by fs.readFileSync in scripts/md-to-word.cjs.\n
Boundary markers: None; the content is processed without safety delimiters.\n
Capability inventory: Shell execution (execSync), file system access (fs), and remote package execution (npx).\n
Sanitization: No escaping or validation is performed on content-derived strings before they are used in shell commands.

md-to-word