The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/autocorrect.ts is vulnerable to command injection because it uses execSync to run a shell command where the filePath variable is interpolated without sanitization. An attacker providing a filename containing shell metacharacters (e.g., using semicolons or backticks) could execute arbitrary system commands.
[EXTERNAL_DOWNLOADS]: The skill uses npx to dynamically download and execute the autocorrect-node package and the bun runtime. Running code from external package registries at runtime introduces risks of supply chain attacks or execution of untrusted code.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it reads untrusted data from user-specified files and performs content analysis to generate summaries and titles (Steps 2 and 3 in SKILL.md).
Ingestion points: Content of the file specified by the user is read into the agent context in Step 1 of the workflow.
Boundary markers: None. No delimiters or instructions are provided to the agent to ignore instructions embedded in the file content.
Capability inventory: The skill has capabilities to read/write/move files and execute shell commands via npx and execSync.
Sanitization: No sanitization or validation is performed on the file content or the file path before use.

baoyu-format-markdown