The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell commands to run its own formatting logic and third-party tools. In scripts/autocorrect.ts, it uses node:child_process.spawnSync to invoke npx for CJK spacing corrections.
[EXTERNAL_DOWNLOADS]: During the typography phase (Step 6), the skill runs npx autocorrect-node. Because autocorrect-node is not listed in the project's local package.json dependencies, npx will attempt to download and execute it from the public NPM registry at runtime.
[INDIRECT_PROMPT_INJECTION]: The skill architecture is vulnerable to indirect prompt injection because it requires the agent to deeply analyze and process external text files provided by the user.
Ingestion points: The skill reads user-specified markdown or plain text files in Step 1 of the workflow described in SKILL.md and performs a detailed content analysis in Step 2.
Boundary markers: The instructions lack explicit delimiters or "ignore embedded instructions" warnings when presenting the file content to the LLM for analysis.
Capability inventory: The skill possesses significant capabilities including reading/writing files (fs.readFileSync, fs.writeFileSync), creating backups, and executing shell commands via spawnSync.
Sanitization: There is no evidence of sanitization, filtering, or escaping of the input content before it is processed by the agent's analysis logic.

baoyu-format-markdown