The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources (such as academic papers or research notes) and uses it to generate complex outputs like LaTeX formulas and Graphviz diagrams. This creates a risk where malicious instructions embedded in the source material could influence the presentation generation process.
Ingestion points: The create [topic] workflow in SKILL.md (Phase 0) reads papers and research materials provided by the user.
Boundary markers: No explicit boundary markers or "ignore instructions" prompts are utilized to separate user data from the agent's internal logic during processing.
Capability inventory: The skill can execute shell commands via subprocess.run (calling pandoc, xelatex, dot, mmdc, and pdftoppm), write files, and run generated Node.js scripts.
Sanitization: Content extracted from papers is interpolated directly into rendering templates. For instance, render_latex.py uses string formatting to build TeX source files, which could be exploited by specially crafted LaTeX control sequences in the input to perform unauthorized actions, such as reading local files during compilation.
[COMMAND_EXECUTION]: The skill uses subprocess.run to invoke various system utilities. In render_diagrams.py, the specific executable used (the engine parameter, e.g., dot, neato) is determined by the input JSON data. While the execution is performed using a list of arguments, allowing the executable name itself to be variable introduces a risk if an attacker can trick the agent into specifying a non-standard executable.
[DYNAMIC_EXECUTION]: The workflow involves generating a Node.js script (generate_slides.js) at runtime which is then executed using node. Because the logic and content of this script are influenced by untrusted external data, there is a risk that malicious input could lead to the execution of unintended code within the Node.js environment.

powerpoint-slides