The Agent Skills Directory

[COMMAND_EXECUTION]: The skill defines shell command templates using curl and gh api that directly interpolate user-provided input from the ${var} variable (parsed into arg, topic, or owner/repo). If a user provides input containing shell metacharacters (e.g., ;, &, |, or backticks), it could result in command injection and arbitrary code execution within the agent's environment.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect prompt injection by ingesting data from multiple untrusted external sources, including web search results, full-page content via WebFetch, and repository metadata (READMEs, PRs, and Issues) via the GitHub API. This data is used to construct the article body and image generation prompts.
Ingestion points: Web search results, external website content fetched via WebFetch, and GitHub repository content (README, commits, PRs, issues) accessed in SKILL.md.
Boundary markers: The skill does not employ explicit delimiters or boundary markers to isolate untrusted external data from its internal processing instructions.
Capability inventory: The skill has capabilities including local file writes to the output/ directory, network requests via curl and secretcurl, GitHub API interactions via gh api, and system notifications via ./notify.
Sanitization: There is no evidence of sanitization, filtering, or escaping of the external content before it is processed by the agent or interpolated into downstream prompts.
[EXTERNAL_DOWNLOADS]: The skill performs network operations to fetch paper metadata from Semantic Scholar's API and to generate images via the Replicate API. These interactions utilize well-known services and are conducted using established security practices, such as the use of placeholders for API tokens.

article