The Agent Skills Directory

[DYNAMIC_EXECUTION]: Static analysis of the core script scripts/mdq.py identifies the use of yaml.load() without a safe loader. This allows for potential arbitrary code execution if a processed Markdown file contains a malicious YAML payload in its frontmatter.
[COMMAND_EXECUTION]: The script scripts/mdq.py performs shell command execution through subprocess.run(). This pattern is vulnerable to command injection if input from untrusted Markdown files or user-provided arguments is not correctly sanitized.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted Markdown data, which presents a surface for indirect prompt injection attacks.
Ingestion points: Markdown files and directory paths passed to the get, find, scan, run, and set commands.
Boundary markers: The skill utilizes headings, GFM table rows, and explicit markers () to define data boundaries.
Capability inventory: The skill has permissions to read and write files and execute subprocess commands.
Sanitization: The protocol suggests masking HTML comments and opaque code blocks to prevent instruction leakage, though the implementation details are contained in the unreviewed script.

queryable-markdown