The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill includes functionality in scripts/md/utils/languages.ts to dynamically fetch and execute JavaScript language grammars from a remote Alibaba Cloud OSS bucket (https://cdn-doocs.oss-cn-shenzhen.aliyuncs.com) using the import() function. This allows for arbitrary code execution in the agent's environment if the remote CDN or the specific files are compromised.
[EXTERNAL_DOWNLOADS]: The scripts/main.ts entry point contains a downloadFile function that fetches images from arbitrary user-provided URLs and saves them to a local temporary directory. While it attempts to use a secure path, downloading external content to the local filesystem is a known attack surface.
[DATA_EXFILTRATION]: The PlantUML extension (scripts/md/extensions/plantuml.ts) encodes and sends diagram code blocks to an external server (https://www.plantuml.com/plantuml) for rendering. This results in the exposure of potentially sensitive diagram content to a third-party service.
[COMMAND_EXECUTION]: The SKILL.md instructions and internal logic rely on shell command execution via npx -y bun and bash for configuration checks and project-level preference resolution.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted Markdown data and includes a workflow step that uses AskUserQuestion to interact with the user based on the content (e.g., CJK character detection). This interaction surface lacks explicit boundary markers, potentially allowing instructions embedded in the Markdown to influence the agent's subsequent actions.
[DYNAMIC_EXECUTION]: The skill uses dynamic library loading and runtime code registration for several features, including infographics (@antv/infographic) and highlight.js language grammars, increasing the complexity and risk profile of the execution environment.

tuzi-markdown-to-html