The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to use the sips system utility to optimize images. The command sips --resampleWidth <W> --resampleHeight <H> <file> uses arguments derived from the page context. If the width, height, or file path are influenced by untrusted input (such as malicious metadata in a markdown file), it could lead to command injection.
[COMMAND_EXECUTION]: The checklist at the end of the skill suggests spawning an HTTP server to verify the generated pages. Executing shell commands to start a network service based on skill instructions can be abused if the configuration is influenced by malicious content.
[PROMPT_INJECTION]: The skill performs indirect prompt injection as it processes external markdown content and file structures without boundary markers or sanitization.
Ingestion points: Reads markdown content to generate HTML pages and checks existing file structures in the docs/ directory.
Boundary markers: No explicit delimiters or instructions are provided to the agent to ignore or isolate embedded instructions within the source markdown.
Capability inventory: The skill can write files to the local filesystem, execute shell commands (sips, HTTP server), and potentially invoke other agent skills (/chatgpt-image).
Sanitization: There is no requirement or instruction to sanitize the input markdown or validate the metadata before using them in HTML generation or shell commands.

html-pages