The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/yuque_lakebook_export/lake_setup.py uses yaml.load() with the unsafe yaml.Loader (line 198) to process table-of-contents data extracted from user-provided .lakebook files. This pattern allows for arbitrary Python object instantiation and potential remote code execution if a user processes a maliciously crafted input file.
[COMMAND_EXECUTION]: The convert_to_md function in scripts/yuque_lakebook_export/lake_setup.py executes shell commands via os.system() to open the output folder (lines 354, 356, 358). The output path, which can be influenced by input file metadata or user configuration, is concatenated into the command string without proper shell escaping or quoting, enabling command injection via filenames or paths containing shell metacharacters like semicolons or backticks.
[INDIRECT_PROMPT_INJECTION]: This skill ingests and processes Yuque document content from external files, which the agent is then tasked with verifying. This creates a vulnerability where malicious instructions within a document could attempt to hijack the agent's session or influence its next actions.
Ingestion points: scripts/yuque_lakebook_export/lake_setup.py and scripts/yuque_lakebook_export/lake_reader.py read and unpack content from .lakebook archives.
Boundary markers: No explicit delimiters or instructions are provided in SKILL.md to prevent the agent from obeying instructions found within the processed files.
Capability inventory: The skill has the ability to write to the file system, perform network requests to download assets (requests.get in lake_handle.py), and execute shell commands (os.system in lake_setup.py).
Sanitization: While basic filename sanitization is performed in lake_handle.py, there is no validation or filtering of the document body content to prevent embedded instructions from being interpreted by the agent.

yuque-lakebook-export