The Agent Skills Directory

COMMAND_EXECUTION (MEDIUM): The skill executes a shell command with an interpolated variable that is not properly sanitized for shell metacharacters.
Evidence: In scripts/autocorrect.ts, the applyAutocorrect function calls execSync("npx autocorrect-node --fix \"${filePath}\"", { stdio: "inherit" });.
Risk: If an attacker can control the filePath (e.g., by providing a file with a name like test.md"; touch exploit; "), they can execute arbitrary shell commands on the host system.
EXTERNAL_DOWNLOADS (LOW): The script uses npx to execute external tools, which can lead to runtime code downloads.
Evidence: Usage of npx autocorrect-node in scripts/autocorrect.ts.
Risk: npx may fetch and execute packages from the npm registry at runtime if they are not cached, introducing unverified third-party code.
PROMPT_INJECTION (LOW): The skill processes untrusted markdown content, creating a surface for indirect prompt injection.
Ingestion points: readFileSync(filePath, "utf-8") in scripts/main.ts reads the content of local markdown files.
Boundary markers: None. The skill parses the content directly into an AST and back to a string without using delimiters to isolate untrusted data.
Capability inventory: The skill can write to the filesystem (writeFileSync) and execute shell commands (execSync).
Sanitization: The script performs no validation or sanitization of the input file content or the file path variable used in the shell execution.

baoyu-format-markdown