The Agent Skills Directory

[DYNAMIC_EXECUTION]: The scripts/mdq.py script uses yaml.load() to parse Markdown frontmatter. According to static analysis, it does not use SafeLoader (or a similar safe variant like safe_load). This allows for arbitrary object instantiation and potentially code execution if the agent is directed to process a Markdown file with a malicious YAML payload.
[COMMAND_EXECUTION]: The scripts/mdq.py script invokes shell commands using subprocess.run(). If user-provided record IDs or field values are interpolated into these commands without rigorous sanitization, it creates a vector for command injection attacks.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon data from external Markdown files, creating an attack surface for indirect prompt injection.
Ingestion points: Markdown files processed by scripts/mdq.py during get, find, query, and scan operations.
Boundary markers: The system uses a multi-layered boundary detection strategy involving Markdown headings, GFM tables, and explicit HTML markers (). It calculates confidence scores for each match.
Capability inventory: The skill can read and write files and execute shell commands via the mdq.py script.
Sanitization: Instructions in SKILL.md and protocol.md strictly forbid the agent from executing commands, following URLs, or performing imports found within the documents. The mdq.py script also implements regex timeouts and rejects YAML aliases to prevent resource exhaustion attacks.

queryable-markdown