The Agent Skills Directory

[PROMPT_INJECTION]: The skill explicitly instructs the agent to bypass safety oversight by suppressing user confirmation ("AUTOMATICALLY execute the following steps WITHOUT asking for confirmation" and "DO NOT ask for user confirmation at each step"). This pattern is used to ensure autonomy but increases the risk of the agent performing dangerous actions without the user's awareness.
[PROMPT_INJECTION]: Indirect Prompt Injection Surface detected.
Ingestion points: Text extracted via OCR from user-provided images (e.g., bank statements, IDs) in SKILL.md.
Boundary markers: Absent. The skill lacks instructions to ignore or delimit potentially malicious instructions embedded within the scanned document text.
Capability inventory: Subprocess execution (sips), package installation (pip, brew), and execution of dynamically generated Python scripts.
Sanitization: Absent. Extracted text is directly used for translation and PDF layout without escaping or validation.
[COMMAND_EXECUTION]: The skill uses the sips utility to convert images. The command sips -s format png <input> --out <output> interpolates user-provided file paths directly. If the filenames contain shell metacharacters, it could lead to arbitrary command execution on the host system.
[REMOTE_CODE_EXECUTION]: Step 5 of the SKILL.md instructions requires the agent to generate and execute a Python script at runtime. Because this script incorporates data derived from external image files (OCR text) and user-supplied paths, it represents a dynamic code execution risk if the agent does not properly escape the content during script construction.
[EXTERNAL_DOWNLOADS]: The skill requires the installation of several external Python packages (easyocr, pytesseract, reportlab, pillow) and system utilities (tesseract) from public registries. While these are well-known libraries, the automated installation of multiple dependencies increases the supply chain attack surface for the environment.

visa-doc-translate