The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill explicitly instructs the user or agent to run curl -fsSL https://drop-sh.fullyjustified.net | sh in both routes/latex.md and scripts/setup.sh. This pattern downloads and executes unverified remote code directly in the shell, which is a high-risk vector for system compromise.
[EXTERNAL_DOWNLOADS]: The skill performs multiple unverified runtime downloads and installations of dependencies. scripts/pdf.sh executes global npm installations for playwright and triggers the download of the chromium browser, in addition to installing pikepdf and pdfplumber via pip. Furthermore, scripts/compile_latex.py includes logic to dynamically install the pypdf library using pip if it is missing during execution.
[COMMAND_EXECUTION]: The skill uses Python's subprocess module to execute system commands for its core functionality. scripts/cmd_convert.py invokes soffice (LibreOffice) for format conversion, while scripts/compile_latex.py calls the tectonic binary for LaTeX processing. scripts/browser_helper.js also uses system calls to locate browsers and manage Node.js packages.
[DATA_EXFILTRATION]: In scripts/html_to_pdf.js, the skill uses Playwright to render HTML files using the file:// protocol. This processing of potentially untrusted HTML data in a browser environment provides a surface for reading local files, which could lead to data exposure, although browser-level sandboxing remains a factor.

pdf