The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill explicitly instructs the agent to bypass security controls by using a specific flag to disable the execution sandbox. This is justified in the text as a workaround for CJK (Chinese, Japanese, Korean) font rendering issues in PDF/PPTX exports, but it effectively removes a critical security layer during command execution.
Evidence: "Run PDF and PPTX exports with dangerouslyDisableSandbox: true."
Evidence: "Bash call must set dangerouslyDisableSandbox: true — sandboxed Chrome loses CJK fonts silently"
[INDIRECT_PROMPT_INJECTION]: The skill processes user-provided markdown files and passes them to an external CLI tool with flags that increase the attack surface.
Ingestion points: User-supplied markdown files (INPUT.md) are processed via sed, grep, and npx @marp-team/marp-cli.
Boundary markers: Absent. There are no instructions to validate the content of the markdown file or ensure it doesn't contain malicious references.
Capability inventory: The skill uses Read, Bash, Glob, and Grep. It specifically uses the --allow-local-files flag with marp-cli, which allows the tool to read arbitrary local files referenced in the markdown.
Sanitization: Absent. No sanitization is performed on the input file content before processing.
Risk: A malicious markdown file could use the --allow-local-files capability to exfiltrate sensitive data (like .env or configuration files) into the rendered output (PDF/HTML).
[COMMAND_EXECUTION]: The skill relies on npx to fetch and execute the @marp-team/marp-cli package. While this is a well-known tool, executing packages directly from a registry introduces a dependency on the integrity of the remote source.
Evidence: npx @marp-team/marp-cli INPUT.md -o OUTPUT.pdf ...
[EXTERNAL_DOWNLOADS]: The skill fetches the Marp CLI tool from the official NPM registry at runtime.
Evidence: Uses npx to invoke @marp-team/marp-cli.

marp-export