The Agent Skills Directory

[DATA_EXFILTRATION]: The skill exposes methods like read_file_path and build(path=...) that allow reading content from arbitrary filesystem paths. When combined with methods like compile_response or the generate endpoint, this creates a vector for reading and transmitting sensitive system files via HTTP responses.
[COMMAND_EXECUTION]: The documentation indicates that the read_file_path method can process .tar.gz archives and 'extracts all'. This operation is a classic vector for path traversal (Zip Slip) attacks if the tool does not strictly validate that the filenames within the archive do not contain parent directory references (e.g., ../../etc/passwd).
[DYNAMIC_EXECUTION]: The skill uses the typst-py package to compile Typst markup in-process. Typst is a Turing-complete layout engine, and its compilation process involves executing logic. Furthermore, the skill is explicitly exposed in Frappe's safe_exec globals, which could allow server scripts to bypass intended sandbox restrictions through complex document generation tasks.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data that is interpolated into the document compilation process.
Ingestion points: The raw markup argument, the sys_inputs dictionary, and the content of external .typ files or Frappe File documents.
Boundary markers: No explicit delimiters or 'ignore' instructions are documented for handling untrusted input within the templates.
Capability inventory: The skill can read local files, write new files to the Frappe database (compile_and_save), and generate network responses (compile_response).
Sanitization: While sys_inputs values are required to be strings, there is no evidence of sanitization to prevent malicious Typst markup injection from these variables.

frappe-typst-expert