The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted text data from user-provided files to generate new agent instructions (SKILL.md and reference files). Malicious instructions embedded within a source book could be 'extracted' as a valid framework and included in the resulting skill, potentially influencing the behavior of the agent when the generated skill is used.
Ingestion points: The agent reads contents of user-specified .txt files in workflows/convert-book.md (Step 2) and workflows/analyze-book.md (Step 1).
Boundary markers: The instructions lack specific boundary markers or directives to ignore instructions that may be embedded within the source text being analyzed.
Capability inventory: The skill has the capability to write multiple files to the file system and create directory structures to store the generated skills.
Sanitization: There is no evidence of sanitization or filtering to prevent the extraction of instructions or code-like patterns from the source text.
[COMMAND_EXECUTION]: The workflow documentation in workflows/convert-formats.md includes shell commands for converting various file formats using external utilities (ebook-convert, pdftotext, pandoc, sed). While these are intended for user guidance, an agent following these workflows will execute shell commands with user-provided file paths.
[EXTERNAL_DOWNLOADS]: The skill references and provides installation instructions for several well-known external tools including Calibre, Poppler, and Pandoc. These are legitimate, well-known software packages, but they represent external dependencies required for the skill's extended functionality.

book-to-skill