The Agent Skills Directory

[COMMAND_EXECUTION]: The typography script uses execSync to run shell commands with variable interpolation.
Evidence: In scripts/autocorrect.ts, the code executes: execSync(npx autocorrect-node --fix "${filePath}", { stdio: "inherit" });.
Risk: Because the filePath variable is interpolated directly into a shell string, a maliciously crafted filename (e.g., one containing shell metacharacters like backticks or semicolons) could allow for arbitrary command execution on the host system.
[EXTERNAL_DOWNLOADS]: The skill downloads and executes external tools at runtime.
Evidence: SKILL.md instructs the agent to run npx -y bun, and scripts/autocorrect.ts calls npx autocorrect-node.
Observation: These tools are fetched from the npm registry, a well-known service.
[DYNAMIC_EXECUTION]: The skill dynamically assembles shell commands for execution.
Evidence: The typography fixing logic in scripts/autocorrect.ts constructs a command string at runtime using local variables.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-supplied markdown files while maintaining significant capabilities.
Ingestion points: SKILL.md (Step 1: Read Source File) reads user-specified markdown or plain text files.
Boundary markers: Absent. The instructions do not define delimiters or provide "ignore embedded instructions" warnings when processing the source file content.
Capability inventory: The skill has the ability to write files (fs.writeFileSync), perform shell operations (bash for backups in Step 6), and execute sub-processes (execSync in typography scripts).
Sanitization: Absent. No filtering or escaping is applied to the content read from the source files before the agent analyzes it to generate summaries or titles.
Risk: Malicious instructions embedded within a document could attempt to hijack the agent's workflow during the analysis or formatting steps.

canghe-format-markdown