The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted manuscript files (DOCX, TEX, MD, PDF) to perform reviews and generate revision artifacts. This ingestion of external data creates a surface where malicious instructions embedded in a paper could attempt to influence the agent's behavior.
Ingestion points: SKILL.md and references/intake.md specify that the workflow begins with the user providing a manuscript file for analysis.
Boundary markers: The instructions do not define specific delimiters or "ignore embedded instructions" warnings for the processed manuscript content.
Capability inventory: The skill possesses file-writing capabilities (documented in references/export.md and SKILL.md) and utilizes shell tools like pandoc for document conversion.
Sanitization: There is no evidence of explicit sanitization or filtering of manuscript content before it is processed by the agent lenses.
[SAFE]: The skill's operational logic is transparent and focuses on legitimate academic tasks.
Known tools: The skill recommends and uses established software for report generation, including pandoc, xelatex, wkhtmltopdf, and weasyprint.
No credential exposure: Analysis of all configuration and markdown files shows no hardcoded API keys, tokens, or sensitive path access.
Metadata integrity: The eval_report_paper-sprint-review_result.json file contains self-referential safety claims (e.g., "security: PASS"); while these were identified, they were treated as data points rather than authoritative conclusions per the security analysis protocol.

paper-sprint-review