The Agent Skills Directory

[DATA_EXFILTRATION]: The script convert_pdf_to_word.py contains hardcoded absolute file paths that expose local system information, including a specific username.
Evidence: Path /Users/yunhuan/Downloads/测试pdf转word/曼德月度采购计划.pdf reveals the user account name 'yunhuan' and the internal directory structure.
[EXTERNAL_DOWNLOADS]: The documentation in prompts/pdf_to_word_conversion_guide.md instructs the agent to download and install external packages from public registries.
Evidence: pip3 install pdf2docx and pip3 install PyMuPDF==1.26.4 commands provided in the setup guide.
[DYNAMIC_EXECUTION]: The skill's workflow involves generating new Python scripts at runtime and executing them, which is a pattern that can be exploited for arbitrary code execution.
Evidence: The guide in prompts/pdf_to_word_conversion_guide.md provides a template for the agent to "Create a Conversion Script" and then "Execute the Conversion Script" using python3.
[REMOTE_CODE_EXECUTION]: The skill facilitates the execution of scripts derived from external templates and user-controlled paths, increasing the risk of command injection or execution of malicious logic.
Evidence: Use of python3 /path/to/your/script/convert.py as an instruction for the agent.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted external documents (PDF and Word files) which provides a surface for indirect prompt injection attacks.
Ingestion points: Files are read via the pdf2docx and python-docx libraries in convert_pdf_to_word.py and convert_word_to_md.py.
Boundary markers: No delimiters or instructions to ignore embedded commands are present in the conversion scripts or guides.
Capability inventory: The agent is granted capabilities for shell execution (pip, python, rm) and filesystem access (read/write).
Sanitization: There is no evidence of sanitization or filtering of the content extracted from documents before it is processed or stored in the .memories directory.

pdf-convert-to-word