The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using python.exe and uv run to convert documents via the anydoc package. These commands incorporate user-supplied file paths (<文件路径>) directly into the command string (python -c "import anydoc; md=anydoc.to_markdown('<文件路径>')"). This pattern creates a risk of command injection if the agent does not properly escape or validate the input.
[DYNAMIC_EXECUTION]: The skill uses uv run --with firecrawl-anydoc and python -c to dynamically load and execute code at runtime for document conversion. This involves invoking a Python interpreter to execute logic defined in a string, which is a form of dynamic code execution on potentially untrusted paths.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted external content from URLs (webpages, X/Twitter, WeChat) and various file formats (PDF, DOCX).
Ingestion points: The ingest and batch-ingest workflows in SKILL.md and docs/WORKFLOWS.md ingest raw text from external sources.
Boundary markers: The instructions lack explicit boundary markers or "ignore instructions" wrappers for the raw content during the Step 1 analysis phase.
Capability inventory: The skill has capabilities to write files to the knowledge base, execute shell commands (via anydoc), and perform network searches.
Sanitization: There is no mention of sanitizing or filtering instructions embedded in the ingested content, leaving the agent's Step 1 CoT analysis vulnerable to malicious prompts hidden in source documents.
[EXTERNAL_DOWNLOADS]: The skill references and downloads external tools and packages:
Fetches the firecrawl-anydoc package via uv or pip for document conversion.
References the baoyu-url-to-markdown and wechat-article-search skills.
References Microsoft's markitdown for fallback conversion. These sources are well-known or author-related, but they involve remote code acquisition.

llm-wiki