The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests untrusted data from external sources and possesses high-privilege capabilities.\n
Ingestion points: The skill is designed to read a wide variety of external files including PDFs, BibTeX, scripts, and Markdown documents from project directories, as specified in SKILL.md and the various templates.\n
Boundary markers: There are no explicit delimiters or specific instructions in the templates (templates/source-card.md, templates/paper-card.md) to guide the agent to ignore any malicious instructions that might be embedded within the source documents.\n
Capability inventory: The skill allows access to Bash, WebFetch, and WebSearch tools via its allowed-tools configuration. Furthermore, the extract-implementation-hints mode specifically directs the agent to identify and extract reusable commands and scripts from the ingested files, which could be leveraged by an attacker to execute malicious commands.\n
Sanitization: No content sanitization or validation measures are defined for the data read from external sources before it is interpreted by the agent.

reference-reading-summarizer