The Agent Skills Directory

[COMMAND_EXECUTION]: The Patent Drafter agent (agents/patent-drafter.md) is instructed to execute shell commands to generate PDFs and images. These instructions use a template that interpolates the user-provided invention title directly into a shell command: `python3 ${SKILL_PATH}/scripts/markdown_to_pdf.py --input ... --title "Patent Application
[INVENTION TITLE]". An attacker could provide an invention title containing shell metacharacters (e.g., "; rm -rf / #`) to execute arbitrary commands on the host system.
[DATA_EXFILTRATION]: The scripts/markdown_to_pdf.py script contains a function embed_images_as_base64 that parses Markdown image syntax (![alt](path)) and reads the file at the specified path to embed its contents into the PDF. Since the Markdown content is generated based on untrusted user descriptions, an attacker could trick the agent into including sensitive local files (such as ~/.ssh/id_rsa or .env files) in the final PDF document, leading to significant data exposure.
[INDIRECT_PROMPT_INJECTION]: The skill has a large attack surface as it ingests invention details, patent numbers, and goals without any sanitization or boundary markers. This untrusted data is interpolated into prompts for specialized agents and external scripts, allowing an attacker to inject instructions that could manipulate the agent's behavior or exfiltrate data.
[EXTERNAL_DOWNLOADS]: The skill requires the installation of external Python packages markdown and weasyprint. The instructions do not specify versions or provide integrity hashes, which could lead to the installation of compromised or incompatible versions of these libraries.

patent-lawyer-agent