The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill attempts to dynamically install and execute an external dependency from a third-party, untrusted source. In tools/book_to_skill_setup.py, the code fetches the README from https://github.com/virgiliojr94/book-to-skill to extract and run an installation command via npx or git clone. This allows for the execution of unverified remote code in the agent's environment.
[EXTERNAL_DOWNLOADS]: The skill downloads content from untrusted external sources at runtime. Specifically, tools/book_to_skill_setup.py fetches installation scripts and code from the virgiliojr94/book-to-skill GitHub repository.
[COMMAND_EXECUTION]: The skill uses subprocess.run with shell=True to execute commands fetched from a remote README or hardcoded fallback commands involving npx and git. This is documented in tools/book_to_skill_setup.py and tools/stdio_utf8.py.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect prompt injection.
Ingestion points: The skill extracts text from external PDF files using tools/pdf_text.py and tools/ingest_case.py to generate patent response drafts.
Boundary markers: No explicit boundary markers or instructions to ignore embedded commands in the processed text were identified.
Capability inventory: The skill can write files to the filesystem (Obsidian vault via vault_layout.py), make network requests to various LLM providers (tools/embed.py), and execute shell commands (tools/book_to_skill_setup.py).
Sanitization: There is no evidence of sanitization or filtering of the extracted text before it is interpolated into the agent's context for draft generation.
[DYNAMIC_EXECUTION]: The skill employs dynamic execution techniques. It uses __import__ in tests (tests/test_oa_store.py) and dynamically executes shell commands constructed from remote string content in tools/book_to_skill_setup.py.

patent-oa