The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run() to interface with the Joplin CLI. While it uses the safer list-based argument format, user-supplied inputs such as notebook names and note titles are passed directly as arguments. This could lead to argument injection if a user provides strings starting with dashes (e.g., --some-flag) or other control characters that the Joplin CLI might interpret as commands rather than data.
[INDIRECT_PROMPT_INJECTION]: The skill's primary purpose is to import external markdown documents and mermaid diagrams, which often originate from untrusted sources (web searches, user uploads). There is a risk that these documents contain malicious instructions intended to manipulate the agent during the publishing process.
Ingestion points: The publish_to_joplin and batch_import functions ingest note content, title, and tags from external inputs.
Boundary markers: None are implemented; the content is processed directly into Joplin notes.
Capability inventory: The skill has the ability to write temporary files, execute local CLI commands via subprocess, and make network requests via the Joplin API.
Sanitization: There is no evidence of sanitization or validation for the content or titles before they are processed by the tool chain.

joplin-publisher