The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The installation instructions for the docparse engine (SKILL.md) include the command 'curl -fsSL https://www.sunholo.com/ailang-parse/install.sh | sh'. This pattern downloads a script from an untrusted source and executes it directly in the shell without prior review or integrity checks.
[EXTERNAL_DOWNLOADS]: The skill requires downloading and running tools from various untrusted sources, including the liteparse package from PyPI/GitHub and system-level utilities like poppler.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted documents (PDFs, Office files, images) and converts them to formats for AI use without sanitization or boundary markers. 1. Ingestion points: Reads external files like PDFs and Office documents (SKILL.md). 2. Boundary markers: No instructions for using delimiters or 'ignore instructions' warnings. 3. Capability inventory: Uses Bash, Read, and Write tools to execute commands and write files based on parsed data. 4. Sanitization: Lacks steps for filtering text extracted from potentially malicious documents.
[COMMAND_EXECUTION]: The skill instructs the agent to run CLI tools (lit, docparse) with parameters such as filenames directly in the shell, which could lead to command injection if filenames are maliciously crafted.
[CREDENTIALS_UNSAFE]: The skill instructs users to run 'gcloud auth application-default login' to enable AI features, exposing sensitive cloud credentials to the environment where they could be misused if the tools or data are compromised.

document-parse