The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the Bash tool to execute shell commands like mkdir, wc, and pdftotext. It interpolates user-provided input from $ARGUMENTS (specifically <book-slug-or-dir> and <source.pdf>) directly into these command strings without sanitization. An attacker could provide a malicious slug containing shell metacharacters (e.g., ;, &&, or backticks) to execute arbitrary commands with the agent's privileges.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8).
Ingestion points: The skill reads untrusted data from local Markdown files in corpus/alan_hirsch/<book-slug>/ and external PDF/EPUB source files.
Boundary markers: There are no explicit boundary markers or instructions telling the agent to treat the book content strictly as data and to ignore any embedded instructions.
Capability inventory: The agent has access to Bash (command execution) and Write (file system modification).
Sanitization: No sanitization or validation is performed on the text extracted from the books before the agent processes it. A malicious book could contain instructions designed to hijack the agent's execution flow when it reads the samples.

book-audit