The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is vulnerable to shell command injection via the 'url' parameter. It instructs the agent to execute web2md '<url>', which can be bypassed if the URL contains a single quote followed by shell command separators (e.g., ' ; touch /tmp/pwned ; '). This allows arbitrary code execution on the host machine.
[COMMAND_EXECUTION]: The skill directs the agent to perform local installation and build operations using npm install && npm run build && npm link in a hardcoded directory (~/workspace/softaworks/projects/web2md). This triggers the execution of potentially arbitrary and unverifiable code defined in the project's build scripts.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection attack surface. Evidence chain: 1. Ingestion points: The skill retrieves and processes content from arbitrary external URLs via the web2md tool. 2. Boundary markers: The instructions do not define any boundary markers or 'ignore embedded instructions' warnings for the fetched content. 3. Capability inventory: The skill has access to shell commands (web2md, npm, mkdir), file system writes, and browser automation. 4. Sanitization: No sanitization is performed on the retrieved web content before it is presented to the agent.
[EXTERNAL_DOWNLOADS]: The skill performs external downloads from the public npm registry during the installation phase (npm install). While npm is a well-known service, the specific dependencies fetched for the local web2md project are not pinned or verified within the skill's instructions.

web-to-markdown