The Agent Skills Directory

[DATA_EXPOSURE]: The skill's core functionality relies on reading files from the filesystem using the Path.read_text() method in scripts/markdown_to_pdf.py. While intended for Markdown input, the tool does not restrict the file types or paths it can access, which could allow an attacker to trick the agent into reading sensitive files (e.g., SSH keys, environment variables) and rendering their contents into a PDF.
[COMMAND_EXECUTION]: The skill requires the execution of a Python script (scripts/markdown_to_pdf.py) that performs direct filesystem read and write operations. The workflow involves executing CLI commands via the agent's shell, which is a standard but sensitive capability.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from the filesystem without utilizing boundary markers or explicit instructions for the agent to ignore embedded commands within the source document.
Ingestion points: The input_path parameter in scripts/markdown_to_pdf.py reads content directly into the processing pipeline.
Boundary markers: Absent. The skill does not wrap the input text in delimiters or warn the agent about potentially malicious instructions within the Markdown.
Capability inventory: The script performs file reads (Path.read_text), file writes (SimpleDocTemplate.build), and temporary directory management.
Sanitization: The inline_markup function uses html.escape to prevent HTML tag injection into the ReportLab renderer, but this does not mitigate prompt-level injection targeting the agent's logic.

markdown-to-pdf