The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using the shinkoku CLI tool with user-provided file paths.
Evidence: SKILL.md contains instructions to run shinkoku pdf extract-text --file-path <path> and shinkoku pdf to-image --file-path <path> --output-dir <dir>.
Risk: This pattern is vulnerable to command injection if the agent platform does not strictly sanitize the <path> or <dir> variables before shell execution.
[DATA_EXPOSURE]: The skill's core purpose is to read and structure highly sensitive personal and financial data from tax-related documents.
Evidence: SKILL.md and README.md specify the extraction of payer_name, gross_amount, withholding_tax, and recipient contact information.
Risk: The processing of such data makes the skill a high-value target for exfiltration or manipulation if the agent context is compromised.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted external data (PDFs and images) and processes it via OCR/Vision, creating an attack surface for indirect prompt injection.
Ingestion points: User-supplied image and PDF files processed via the read tool and shinkoku CLI.
Boundary markers: The skill uses specific delimiters (---PAYMENT_STATEMENT_DATA---) for output, but does not provide the LLM with instructions to ignore potential commands embedded within the document text.
Capability inventory: The skill has access to shell execution (shinkoku), sub-agent spawning for dual verification, and file system access (read, glob).
Sanitization: There is no evidence of text sanitization or safety filtering applied to the content extracted from the documents before it is processed by the agent or sub-agents.

reading-payment-statement