The Agent Skills Directory

[COMMAND_EXECUTION]: The function format_file in formatter.py executes a shell command using subprocess.run with bash -c. The command string is constructed using an f-string that interpolates the path variable directly. Because this variable is derived from user input, an attacker can inject additional commands by including shell metacharacters (e.g., ;, &, |, or backticks) in the filename, leading to arbitrary code execution.
Evidence: subprocess.run(["bash", "-c", f"chmod 644 {path}"], check=True)
[COMMAND_EXECUTION]: The skill uses subprocess.run to call the external system utility pandoc. While the arguments are passed as a list (which is safer than a raw string), the skill relies on the presence and security of this external binary on the host system to perform its primary function.

markdown-formatter