The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses curl, basename, and various CLI tools (trafilatura, reader, pdftotext) to process user-supplied URLs. While variables are generally quoted, the logic relies on untrusted external data for local file operations.
[PRIVILEGE_ESCALATION]: The PDF download logic uses PDF_FILENAME=$(basename "$URL") and then writes the downloaded content using curl -L -o "$PDF_FILENAME". An attacker-controlled URL ending in a sensitive filename (e.g., https://attacker.com/.bashrc or https://attacker.com/.env) could cause the agent to overwrite local configuration or sensitive files in its current working directory.
[PERSISTENCE]: The file overwrite vulnerability mentioned in the privilege escalation section could be exploited to achieve persistence by modifying shell startup scripts (like .bashrc) if the agent's environment permits writing to such files.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through its content extraction workflow.
Ingestion points: The skill reads full text from external web articles and PDF documents (SKILL.md, Step 2).
Boundary markers: None are present; the skill directly passes extracted content to the planning logic without delimiters or instructions to ignore embedded commands.
Capability inventory: The agent has Bash, Read, and Write capabilities, which could be abused if the agent follows instructions found within the extracted content.
Sanitization: No content filtering or sanitization is performed on the extracted text before it is processed by the agent to create the "Ship-Learn-Next" plan.

tapestry