The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/md_to_pdf.py uses subprocess.check_call within the check_dependencies function to automatically install missing Python packages using pip. While the packages listed (reportlab, markdown, beautifulsoup4, html5lib, tqdm) are well-known, executing installation commands at runtime is a sensitive capability that modifies the execution environment.
[DYNAMIC_EXECUTION]: The script uses the __import__ function in scripts/md_to_pdf.py to dynamically check for the presence of required modules. Although the module names are sourced from a hardcoded dictionary, dynamic loading is a pattern that can be misused for obfuscation or loading arbitrary code.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted Markdown content and identifies potential injection surfaces:
Ingestion points: Markdown files processed by scripts/md_to_pdf.py.
Boundary markers: None identified in the script or instructions.
Capability inventory: File reading via open(), network requests via urllib.request.urlopen, command execution via subprocess.check_call, and file writing via doc.build().
Sanitization: The script uses BeautifulSoup to parse HTML generated from Markdown, but the _load_image function downloads images from any URL provided in the src attribute. This creates a Server-Side Request Forgery (SSRF) surface where a malicious Markdown file could force the agent to probe internal network resources or cloud metadata services (e.g., 169.254.169.254).
[EXTERNAL_DOWNLOADS]: The _load_image function in scripts/md_to_pdf.py fetches image content from external HTTP/HTTPS URLs and writes them to temporary local files. This behavior is documented in the skill features but represents an unvalidated download of external data.

md-to-pdf