The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes markdown files from a user-provided directory using Pandoc and WeasyPrint. This creates a surface where malicious instructions or rendering exploits (e.g., CSS injection) could be embedded in the documentation files processed by the agent.
Ingestion points: Markdown files are collected from <input-dir> in scripts/generate-pdf.sh using glob patterns like [0-9][0-9]-*.md.
Boundary markers: None; the content is passed directly to the conversion tools.
Capability inventory: The script executes pandoc (conversion) and weasyprint (rendering), which are powerful document processing engines.
Sanitization: No sanitization is performed on the content of the markdown chapters or the derived titles before processing.
[DYNAMIC_EXECUTION]: The script generate-pdf.sh dynamically generates a sed command file at runtime based on filenames and heading text found in the input directory.
Evidence: The script constructs $SED_SCRIPT by appending substitution commands using echo and then executes it via sed -f "$SED_SCRIPT".
Risk: If a filename matches the glob pattern but contains the pipe character | (e.g., 01-|malicious|.md), it could break the sed command syntax (s|...|...|g), potentially leading to logic corruption or execution errors during the link resolution phase.
[COMMAND_EXECUTION]: The skill relies on the execution of external binaries including pandoc, weasyprint, and sed. While these are necessary for the primary purpose of the skill, they represent a high-capability execution environment that handles untrusted file data.

pdf-generation