The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/export-pdf.sh script is vulnerable to multiple injection attacks:\n
Python Command Injection: The script determines the PDF page count by interpolating the file path into a single-quoted Python string within a subprocess call: pymupdf.open('$pdf_file'). A filename containing a single quote (e.g., test');import os;os.system('id');('.md) allows an attacker to break out of the string literal and execute arbitrary Python code.\n
Pandoc Flag Injection: The script extracts a document title from the first line of the input Markdown and interpolates it directly into the pandoc command line: --metadata title="$title". A title containing double quotes (e.g., Title" --lua-filter=exploit.lua) can escape the metadata argument and inject arbitrary flags into the pandoc process, potentially leading to code execution through malicious Lua filters.\n- [EXTERNAL_DOWNLOADS]: The skill's documentation and environment setup script (scripts/check-env.sh) provide instructions to download font files from external sources, including a third-party GitHub repository (subframe7536/maple-font) and Google's font repository. While these assets are intended for PDF rendering, downloading binary files from unverified third-party repositories presents a supply chain risk.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted Markdown content and filenames that are subsequently used to construct shell commands. This creates a significant attack surface where a maliciously crafted file can trigger the command injection vulnerabilities identified above.\n
Ingestion points: Filenames and the first line of content from Markdown files processed by scripts/export-pdf.sh.\n
Boundary markers: No delimiters or isolation techniques are employed to ensure that the data is treated as literal text rather than command components.\n
Capability inventory: The skill possesses the ability to execute subprocesses (pandoc, python3), access the local file system, and perform network operations via curl and gh.\n
Sanitization: The script lacks any escaping, validation, or sanitization of filenames or extracted metadata before they are used as command-line arguments.

export-pdf