The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a shell command to execute a local Node.js script with a user-provided file path. If the path variable is not properly sanitized by the platform, it could lead to arbitrary shell command injection.
Evidence: SKILL.md contains the instruction node scripts/extract-data.js "<json-file-path>".
[COMMAND_EXECUTION]: The script scripts/extract-data.js is vulnerable to path traversal during file creation. It uses keys directly from the input JSON to construct file paths without validation, allowing a malicious JSON to write files outside the intended directory.
Evidence: const outputPath = path.join(jsonFileDir, ${key}.md); in scripts/extract-data.js.
[PROMPT_INJECTION]: The skill instructs the agent not to read the content of the files it is processing, which could be an attempt to bypass agent-side safety inspections of large or malicious payloads.
Evidence: SKILL.md states '禁止读取文件的具体内容, 因为文件通常很大' (Prohibit reading the specific content of the file, because files are usually large).
[PROMPT_INJECTION]: Indirect Prompt Injection Surface. The skill processes untrusted external JSON data and uses it to drive file system operations without sanitization.
Ingestion points: fs.readFile(jsonFilePath, "utf8") in scripts/extract-data.js.
Boundary markers: None present in the instructions or script.
Capability inventory: Shell command execution (RunCommand) and file system write access (fs.writeFile).
Sanitization: No validation or escaping is performed on the keys or values extracted from the JSON file.

json-to-markdown-files