The Agent Skills Directory

[COMMAND_EXECUTION]: The Workflow section in SKILL.md instructs the agent to execute shell commands using unvalidated user input: python scripts/query_pubmed.py "<input_pmid>". This pattern is vulnerable to command injection if the input_pmid provided by a user contains shell metacharacters (e.g., semicolons, pipes, or backticks), potentially allowing arbitrary command execution on the host environment.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted external content from medical papers and metadata retrieved from PubMed to perform its screening tasks. \n- Ingestion points: The input_paper variable (full text) and Title/Abstract metadata fetched via scripts/query_pubmed.py. \n- Boundary markers: The instructions lack explicit delimiters or 'ignore instructions' wrappers for the external paper data, increasing the risk that the agent might follow malicious instructions embedded within a paper. \n- Capability inventory: The skill utilizes shell-based scripts (scripts/extract_pdf.py and scripts/query_pubmed.py) which provide a significant impact surface if an injection occurs. \n- Sanitization: No input validation or sanitization routines are defined for the paper text or the PMID variable before they are processed by tools or the LLM.

meta-screening-fulltext