The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The configuration file references/MCP_SETUP.md instructs users to install and run third-party Model Context Protocol (MCP) servers from untrusted GitHub repositories (blazickjp/arxiv-mcp-server, grll/pubmedmcp, 54yyyu/zotero-mcp) using the uvx package runner. This facilitates the execution of arbitrary code from unverified external sources on the host system.
[DYNAMIC_EXECUTION]: The skill documentation promotes the use of uvx, a tool that dynamically fetches and executes Python packages, as the primary method for setting up its environment. This pattern introduces risks associated with dynamic code loading and execution from remote repositories.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process large amounts of external research data from ArXiv, PubMed, and Zotero.
Ingestion points: Tools such as read_paper, search_papers, and zotero_get_item_fulltext mentioned in references/WORKFLOW.md and references/MCP_SETUP.md.
Boundary markers: The skill lacks explicit instructions or markers to delimit external content or warn the agent to ignore instructions embedded within the research papers.
Capability inventory: The agent has capabilities for network search, file reading, and local API interaction.
Sanitization: There are no documented mechanisms for sanitizing or filtering instructions that might be hidden in processed PDFs or metadata.
[METADATA_POISONING]: The skill includes a file named eval_report_medical-imaging-review_result.json which contains a pre-filled security audit claiming a 'PASS' status and 'Production Ready' grade. This is identified as deceptive metadata intended to bypass or influence independent security analysis.
[EXTERNAL_DOWNLOADS]: The core workflow relies on downloading papers and software components from various external sources not listed as trusted vendors, increasing the supply chain risk profile of the skill.

medical-imaging-review