The Agent Skills Directory

[PROMPT_INJECTION]: The skill is highly vulnerable to indirect prompt injection because it converts external, potentially untrusted documents (PDF, Word, YouTube transcripts) into Markdown that is then processed directly by the agent. This allows malicious instructions embedded in those documents to potentially hijack the agent's behavior.\n
Ingestion points: The convert and convert_stream methods in the MarkItDown class are used extensively to process external data.\n
Boundary markers: Absent. The skill provides no instructions to separate the converted text from the agent's primary instructions.\n
Capability inventory: The agent has access to Read, Write, Edit, and Bash tools, providing a broad range of actions that an attacker could trigger.\n
Sanitization: None. No sanitization or escaping is performed on the output of the conversion process.\n- [EXTERNAL_DOWNLOADS]: The documentation encourages the discovery and installation of unverified third-party plugins from GitHub via a hashtag search (#markitdown-plugin). This practice facilitates the execution of code from untrusted sources with unknown security posture.\n- [COMMAND_EXECUTION]: In SKILL.md, the instructions tell the agent to run a schematic generation command using a script (scripts/generate_schematic.py) that is not included in the provided skill files. This may cause the agent to attempt to write and execute its own code to satisfy the requirement, creating a dynamic execution risk.

markitdown