The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is susceptible to shell injection attacks. In SKILL.md, the workflow instructions interpolate unvalidated variables, such as <URL> and <FILE_PATH>, directly into bash commands (e.g., extract-defuddle.sh "<URL>"). An attacker could provide a malicious URL containing shell metacharacters like backticks or subshells to execute arbitrary commands. Additionally, the git branch -m operation uses a branch name derived from content titles, which poses a similar injection risk if not perfectly sanitized.\n- [PROMPT_INJECTION]: The skill processes untrusted content from YouTube, X, and various web pages. This data is fed to the LLM for restructuring and translation without boundary markers or instructions to ignore embedded commands. This facilitates indirect prompt injection, where malicious instructions in the source content could manipulate the agent into using its file system or git capabilities inappropriately.\n- [REMOTE_CODE_EXECUTION]: The extract-doc.sh script uses the uvx tool to dynamically download and execute the markitdown package from PyPI at runtime. While the package originates from a trusted organization (Microsoft), the practice of fetching and executing external code during skill execution introduces risks related to registry integrity and dependency security.

save