The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests untrusted data through the INPUT variable and passes it to powerful execution environments without sufficient isolation.
Ingestion points: The INPUT variable is used across all conversion workflows in SKILL.md.
Boundary markers: No delimiters or instructions are used to treat the input strictly as data.
Capability inventory: The skill has access to shell commands (base64, xxd) and a full Python 3 interpreter.
Sanitization: The input is not sanitized or escaped before being interpolated into scripts.
[DYNAMIC_EXECUTION]: The skill uses shell heredocs to dynamically generate Python scripts at runtime. The INPUT variable is placed inside triple-quoted string literals (data = """${INPUT}"""). A malicious user could provide an input containing triple-quotes to break out of the string literal and execute arbitrary Python code.
[COMMAND_EXECUTION]: The skill executes shell commands using user-supplied variables, such as echo -n "$INPUT" | base64. This pattern can lead to command injection if the underlying shell environment does not properly escape or handle special characters within variables.

encoding-toolkit