The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to install a third-party global NPM package '@kayvan/markdown-tree-parser' using 'npm install -g'. This dependency originates from an unverified individual account and is not part of any recognized trusted organization or the author's own vendor infrastructure.
[COMMAND_EXECUTION]: The workflow involves executing shell commands by interpolating user-provided values directly into the command line: 'md-tree explode {source-document} {destination-folder}'. This creates a surface for command injection if the agent does not properly sanitize file paths containing shell metacharacters.
[DYNAMIC_EXECUTION]: The reference file 'references/document-change-log.md' provides and encourages the use of a 'node -e' shell wrapper to dynamically execute JavaScript logic and load modules. This pattern combines shell script generation with dynamic runtime execution, which can be manipulated if arguments are not handled safely.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and process untrusted markdown files (Source document path) using capabilities that include file system writes and shell execution. While the skill includes basic logic to identify headers, it lacks robust sanitization or strict boundary markers to prevent instructions embedded within the processed document from influencing the agent's actions during the sharding workflow.

shard-doc