The Agent Skills Directory

[COMMAND_EXECUTION]: The convert_to_md function in scripts/yuque_lakebook_export/lake_setup.py uses os.system() to open the output directory after conversion. The directory path, derived from the lakebook filename, is insufficiently sanitized against shell metacharacters. If a user processes a file with a name containing characters like ;, &, or backticks, the system will execute those characters as shell commands when attempting to open the folder.\n- [REMOTE_CODE_EXECUTION]: The load_meta_json function in scripts/yuque_lakebook_export/lake_setup.py uses yaml.load() with the standard Loader to parse Table of Contents data from the $meta.json file inside the .lakebook archive. Using a non-safe loader allows a malicious archive to potentially execute arbitrary Python code by exploiting object instantiation during the YAML parsing process.\n- [EXTERNAL_DOWNLOADS]: The download_resource function in scripts/yuque_lakebook_export/lake_handle.py performs network requests using the requests library to fetch images and attachments. These URLs are extracted directly from the Yuque document content being processed, allowing for arbitrary network connections determined by the input data.\n- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external .lakebook files which are untrusted data sources.\n
Ingestion points: scripts/cli.py and scripts/yuque_lakebook_export/lake_reader.py read and unpack .lakebook files.\n
Boundary markers: Absent. The skill does not use specific delimiters or instructions to prevent the agent from potentially following instructions found within the processed content.\n
Capability inventory: File system writes, shell command execution via os.system, and network operations via requests.\n
Sanitization: Basic path segment sanitization is implemented in lake_handle.py, but it does not account for shell-sensitive characters used in the terminal commands executed at the end of the process.

yuque-lakebook-export-cn