The Agent Skills Directory

[COMMAND_EXECUTION]: The skill constructs and executes several shell commands using dynamic placeholders based on user input or filesystem discovery. Evidence includes:
ls ./site/public/slides/<directory-name>
pdf2jpg <filename>.pdf
rm -f <filename>.pdf
These patterns are susceptible to command injection if the agent does not properly sanitize the directory or file names.
[EXTERNAL_DOWNLOADS]: The skill includes instructions to download and install external software at runtime if a dependency is missing. Evidence:
cargo install swiss-knife is executed if the pdf2jpg command is not found. While crates.io is a standard registry, runtime installation of third-party tools increases the attack surface.
[PROMPT_INJECTION]: The skill processes untrusted external data (images and PDF files) to "understand its content and generate appropriate captions," which presents a surface for indirect prompt injection.
Ingestion points: Processed files located in ./site/public/slides/<directory-name> (Step 4 and Step 5).
Boundary markers: None (No instructions to ignore embedded text in images or PDFs).
Capability inventory: Shell command execution (ls, pdf2jpg, rm, cargo install) and file system modification (.mdx and .astro file generation).
Sanitization: None (No validation or escaping of the content extracted from images).

site-slides