The Agent Skills Directory

[Indirect Prompt Injection] (HIGH): The skill processes untrusted external content from local documents and URLs, creating a vulnerability where malicious instructions in the source files could influence the agent's behavior.
Ingestion points: Local files (.pdf, .docx, .xlsx, .pptx, etc.) and remote URLs via markitdown command.
Boundary markers: Absent; the skill does not wrap output in delimiters or instruct the agent to ignore embedded instructions.
Capability inventory: Full Bash tool access, including file system write capabilities via shell redirection (>).
Sanitization: No sanitization or validation of the ingested content is performed before the agent processes the resulting Markdown.
[Command Execution] (MEDIUM): The skill uses the Bash tool to execute the markitdown CLI.
Risk: If an attacker can control the filename (e.g., via a downloaded file), they might attempt shell injection (e.g., markitdown "; rm -rf /; ".pdf). The skill documentation does not provide guidance on escaping shell arguments.
[Unverifiable Dependencies] (LOW): The skill requires the markitdown Python package.
Trust Scope: This package is maintained by Microsoft (a trusted organization), which downgrades this specific finding to LOW per [TRUST-SCOPE-RULE].

markitdown