The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/md2pdf.mjs executes shell commands to manage its environment.
Evidence: The ensureDeps() function uses execSync to run npm install automatically if dependencies are missing from the local node_modules directory.
[COMMAND_EXECUTION]: The skill spawns a web browser as a separate process to perform rendering.
Evidence: The script uses the puppeteer-core library to launch a local Chrome, Chromium, or Edge instance with flags including --no-sandbox and --allow-file-access-from-files.
[DATA_EXFILTRATION]: The rendering configuration allows for potential exposure of sensitive local files into the output document.
Evidence: The combination of the --allow-file-access-from-files browser flag and the html: true configuration in the markdown-it parser enables an attacker-controlled Markdown file to include HTML elements (such as <iframe> or scripts) that can read local files from the filesystem and include their contents in the generated PDF.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external Markdown data with a high-capability rendering engine, creating an attack surface for indirect injection.
Ingestion points: The script scripts/md2pdf.mjs reads the content of local .md files provided as arguments using fs.readFileSync.
Boundary markers: None; the skill does not use delimiters or warnings to separate user-provided content from instructions.
Capability inventory: The skill has the ability to read and write files, execute shell commands (via npm), and launch subprocesses (the browser).
Sanitization: While the script performs basic escaping for titles and Mermaid diagrams, the main parser is configured to allow raw HTML, allowing embedded malicious instructions or scripts to be executed within the browser context during PDF generation.

markdown-to-pdf