The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The file references/schema.md includes shell commands that utilize sudo to update and install LaTeX packages (sudo tlmgr update --self && sudo tlmgr install collection-fontsrecommended). The agent is explicitly instructed in SKILL.md to refer to these commands for its rendering workflow, which could allow for unauthorized administrative actions.
[COMMAND_EXECUTION]: The skill instructs the agent to execute complex shell pipelines involving pandoc to convert markdown files to PDF or HTML. These commands use dynamic paths and external resources (e.g., ~/.local/share/makerskills/render.css), which may be vulnerable to manipulation if file names or paths are not strictly validated.
[INDIRECT_PROMPT_INJECTION]: The skill architecture relies on ingesting content from potentially untrusted sources, such as files in the user's vault (raw/ folder) and web content retrieved via browser tools. It explicitly designates the vault's CLAUDE.md as the "authoritative schema," instructing the agent to trust its content over built-in instructions. This creates a vulnerability where malicious content within the vault or a fetched website could hijack the agent's logic.
Ingestion points: CLAUDE.md, raw/ vault files, and output from WebFetch or agent-browser (specified in SKILL.md).
Boundary markers: Absent. The instructions do not provide delimiters or warnings to ignore instructions embedded in the processed data.
Capability inventory: File system access (read/write), shell command execution (via pandoc in references/schema.md), and network operations.
Sanitization: Absent. There are no instructions for the agent to filter or escape the external content before processing or using it in shell commands.
[EXTERNAL_DOWNLOADS]: The documentation in references/schema.md promotes the installation of external software packages such as basictex via Homebrew and various TeX Live collections. While these are common tools, providing instructions for an agent to perform system-level installations increases the attack surface.

second-brain