The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a local Node.js script using the Bash tool to perform HWPX generation. It references a hardcoded absolute path in the developer's home directory: /Users/chris_gomdori/workspace/kordoc/dist/cli.js. This exposes local system information (usernames) and may lead to execution failures or unexpected behavior in different environments.
[INDIRECT_PROMPT_INJECTION]: The skill takes user-supplied topics and content as input to generate administrative documents, which are then processed by the kordoc tool.
Ingestion points: User-provided strings via the [작성할 내용/주제] argument in SKILL.md.
Boundary markers: None identified. The content is interpolated directly into Markdown templates.
Capability inventory: The skill uses the Bash tool to run commands and Write/Edit tools to handle files.
Sanitization: There are no explicit instructions to escape or sanitize the user input before it is written to a Markdown file and passed as a shell argument to the node command, which could potentially be exploited if the HWPX generator does not handle malformed Markdown safely.

gongmunseo