The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the agent and user to perform unauthenticated remote script execution from an external domain to install the core utility.
Evidence in SKILL.md: source <(curl -fsSL https://dllf.intsig.net/download/2026/Solution/xparse-cli/install.sh)
Evidence in SKILL.md: irm https://dllf.intsig.net/download/2026/Solution/xparse-cli/install.ps1 | iex (Windows installation pattern)
[EXTERNAL_DOWNLOADS]: The skill fetches executable binaries and scripts from a non-whitelisted external domain (dllf.intsig.net).
[COMMAND_EXECUTION]: The instructions recommend using sudo to install system dependencies, which constitutes an unnecessary escalation of privilege for a document parsing utility.
Evidence in SKILL.md: sudo apt install qpdf and sudo yum install qpdf.
[PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection (Category 8) due to the way it processes untrusted data.
Ingestion points: External document files (PDF, Word, Images, etc.) provided by the user and processed via the xparse-cli tool.
Boundary markers: Absent. There are no delimiters or instructions to ignore embedded commands within the processed documents.
Capability inventory: The skill has the ability to execute shell commands (cat, rm, mkdir), run Python scripts, and perform network requests through the CLI tool.
Sanitization: Absent. The parsed text is directly provided to the agent context without escaping or validation.
[COMMAND_EXECUTION]: The skill employs dynamic execution of generated Python code for PDF splitting and JSON data merging.
Evidence in SKILL.md: python3 -c "from pypdf import PdfReader; ..." and complex multiline Python templates for merging JSON elements.

z-smart-xparse