The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The file references/schema.md provides instructions for the agent to execute sudo tlmgr update --self to update system-level TeX Live components, which requires elevated administrative permissions.
[INDIRECT_PROMPT_INJECTION]: The skill's capture mode in SKILL.md fetches content from arbitrary external URLs and stores it in the raw/ directory. This untrusted data is subsequently re-ingested by the agent during compile and query phases without protective boundary markers or sanitization.
Ingestion points: External web content fetched via WebFetch or agent-browser.
Boundary markers: Absent; the references/templates/raw.md template does not include security delimiters for external content.
Capability inventory: File system writes (SKILL.md), file system reads across the vault, and shell command execution via pandoc (references/schema.md).
Sanitization: None; content is saved as 'cleaned readable text' without further validation.
[DYNAMIC_EXECUTION]: The query mode (documented in references/schema.md) utilizes shell commands to pipe markdown content through pandoc and xelatex. Executing these commands on files that may contain data from untrusted sources (captured URLs) presents a risk of command injection.
[UNVERIFIABLE_DEPENDENCIES]: The skill recommends the installation of external software suites and font packages using brew install --cask basictex and tlmgr, introducing dependencies from third-party repositories.

second-brain