The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/convert.js uses child_process.execSync to run npm install for its dependencies. This is part of its documented zero-deployment feature.\n- [EXTERNAL_DOWNLOADS]: The skill downloads the marked and juice packages from the NPM registry at runtime. As NPM is a well-known service, this is a standard operation for this skill's use case.\n- [REMOTE_CODE_EXECUTION]: The script uses require with a computed path to load the dynamically installed modules marked and juice from a temporary directory.\n- [PROMPT_INJECTION]: The skill processes untrusted Markdown content and lacks sanitization or boundary markers. 1. Ingestion points: mdPath in scripts/convert.js. 2. Boundary markers: Absent in SKILL.md. 3. Capability inventory: child_process.execSync and fs.writeFileSync in scripts/convert.js. 4. Sanitization: Absent.

zhy-markdown2wechat