The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill dynamically loads and executes JavaScript code from a remote third-party CDN.
In scripts/md/utils/languages.ts, the loadAndRegisterLanguage function uses the import() statement to fetch and execute scripts from https://cdn-doocs.oss-cn-shenzhen.aliyuncs.com/npm/highlightjs/11.11.1/es/languages/${language}.min.js.
The language variable is extracted directly from the markdown code block tags provided in the input file, allowing a malicious document to influence which remote script is executed.
[COMMAND_EXECUTION]: The main script executes external commands via the shell.
scripts/main.ts uses spawnSync to invoke npx -y bun to run its rendering logic, which involves running external binaries and potentially fetching packages from the npm registry.
[EXTERNAL_DOWNLOADS]: The skill fetches files and resources from the internet during processing.
scripts/main.ts uses the http and https modules to download remote images specified in the markdown files to a local temporary directory.
scripts/md/extensions/plantuml.ts constructs URLs to the PlantUML server (https://www.plantuml.com/plantuml) to fetch diagram images.
[PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection through processing untrusted data.
Ingestion points: As per the workflow in SKILL.md (Step 0), the agent reads the entire content of the input markdown file to detect Chinese characters.
Boundary markers: The skill lacks markers to delimit the markdown content or instructions to prevent the model from obeying commands found within the data.
Capability inventory: The skill has the ability to execute system commands, load remote code, and write to the file system.
Sanitization: No sanitization or validation is performed on the markdown content or the language identifiers extracted from it.

baoyu-markdown-to-html-skill