The Agent Skills Directory

[COMMAND_EXECUTION]: The skill's bash workflow uses the SLUG variable directly in multiple shell commands, such as gbrain get "$SLUG". If the input is not strictly validated, an attacker could provide a malicious slug containing shell metacharacters (e.g., ;, |, `) to execute arbitrary commands on the host system.
[COMMAND_EXECUTION]: The skill uses the user-supplied SLUG variable to construct a file path: "$BRAIN_DIR/$SLUG.md". Without proper sanitization, this allows for path traversal attacks, potentially enabling the agent to read or process arbitrary files on the system if the gbrain configuration points to a reachable root.
[INDIRECT_PROMPT_INJECTION]: The skill ingests markdown content from external sources ("brain pages") and passes it to a PDF renderer. This creates an attack surface where maliciously crafted markdown could exploit vulnerabilities in the underlying rendering engine (typically a browser-based tool like Playwright/Chromium). The risk is compounded by the skill's ability to exfiltrate the resulting PDF via Telegram or Email.
[PRIVILEGE_ESCALATION]: The instructions mandate the use of the CONTAINER=1 environment variable when running in containerized environments. This flag is documented to skip Chromium sandboxing, which removes a critical layer of security for the PDF rendering process and increases the potential impact of a browser-based exploit.
[PRIVILEGE_ESCALATION]: The documentation suggests that the agent should install missing system fonts using apt install. If the agent executes this, it would likely require sudo or root privileges, violating the principle of least privilege for the agent's execution environment.

brain-pdf