The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using user-provided input, creating a surface for command injection. Specifically, in Document Mode, it runs pdftotext "source.pdf" "/tmp/source.txt", and in Wiki Mode, it executes python scripts/sha256_wiki.py "<wiki>/concepts/". If the agent does not properly escape the <wiki> path or file names containing shell metacharacters (e.g., ;, &, or backticks), it could lead to arbitrary command execution.
[EXTERNAL_DOWNLOADS]: The skill recommends installing external dependencies using system package managers if they are missing. It suggests brew install poppler for macOS and apt-get install poppler-utils for Linux. While these target well-known package registries, runtime installation of third-party software increases the skill's attack surface.
[DATA_EXFILTRATION]: In 'Codebase Mode', the skill is designed to scan for and read project configuration files, including .env files. While the stated purpose is to document environment setup for developer onboarding, reading files that typically contain sensitive credentials (API keys, database passwords) represents a data exposure risk.
[REMOTE_CODE_EXECUTION]: The skill includes and executes a local Python script (scripts/sha256_wiki.py) to compute hashes. While the script's code is currently benign, its execution via a shell tool with arguments derived from external sources (the Wiki path) contributes to the overall execution risk.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) as it processes untrusted content from PDFs, source code, and remote Wikis.
Ingestion points: External PDF files, source code repositories, and user-specified Wiki paths (e.g., concepts/, entities/).
Boundary markers: The skill defines a 'CWD Boundary Rule' for file access, but lacks explicit delimiters (like XML tags) or 'ignore embedded instructions' warnings when the agent reads the content of those files.
Capability inventory: The agent has access to a Bash tool for running pdftotext and python scripts, as well as file system read/write capabilities.
Sanitization: There are no instructions to sanitize or filter the content of ingested files before they are processed by the LLM.

tutor-setup