The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The installation process and utility scripts utilize high-risk remote execution patterns.
The README.md and install.sh files promote a one-line installation command that pipes a remote shell script from the author's GitHub repository (https://raw.githubusercontent.com/yitianlian/markitdown-skill/main/install.sh) directly into the bash interpreter.
The install.sh script suggests fetching an installer from astral.sh, which is a well-known service for Python tooling.
The install.sh script dynamically downloads the SKILL.md file from a remote repository during setup.
[COMMAND_EXECUTION]: The skill instructions involve executing shell commands with user-provided arguments interpolated into strings, which creates a risk for shell command injection.
In SKILL.md, user-supplied values are used directly in commands such as ls -la "$TARGET", markitdown "$FILE_PATH", and within a batch conversion loop. This pattern can be exploited if the input contains shell metacharacters and the agent does not perform strict sanitization.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection from malicious files or web pages.
Ingestion points: Untrusted data enters the agent's context through file paths ($FILE_PATH) and URLs ($URL) processed in SKILL.md.
Boundary markers: Absent; there are no instructions or delimiters provided to help the agent distinguish its primary instructions from the content of converted documents.
Capability inventory: The skill has access to Bash, Read, and Write tools, which could be abused if the agent is manipulated by instructions embedded in a processed document.
Sanitization: There is no evidence of content sanitization or validation of the text extracted from external documents before it is summarized or processed by the agent.

markitdown