The Agent Skills Directory

[COMMAND_EXECUTION]: The script export_deck.py is vulnerable to AppleScript injection. In functions _export_keynote_pdf and _export_powerpoint_pdf, file paths derived from the DECK_FILE environment variable or command-line arguments are interpolated directly into AppleScript strings using f-strings (e.g., set theDoc to open POSIX file "{deck_abs}"). These strings are executed via osascript. An attacker can escape the string literal with a double quote and append malicious AppleScript commands, leading to arbitrary code execution as the current user.
[EXTERNAL_DOWNLOADS]: The skill's documentation explicitly requires the installation of third-party libraries including pymupdf, numpy, and pillow via pip. These are well-known packages used for PDF manipulation and image processing.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it processes untrusted file paths and regex patterns from environment variables without validation.
Ingestion points: DECK_FILE and RESULT_PATTERN environment variables, as well as positional command-line arguments.
Boundary markers: None present; inputs are treated as trusted strings.
Capability inventory: Execution of AppleScript (osascript) and LibreOffice (soffice) via subprocess.run in export_deck.py; file system modifications in upload_figures.py and crop_figures.py.
Sanitization: No escaping or sanitization is performed on file paths before their inclusion in shell-executed AppleScript or on regex patterns before compilation.

cropfig