The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using dynamic input. In references/01-meta-initialization.md, it runs mkdir using a provided workdir path. In references/00-research-standards.md, it specifies the use of curl to download PDF files from URLs discovered on the web. While the author provides explicit security instructions to use single quotes and avoid shell metacharacters to prevent command injection, the use of shell commands with untrusted input is a known security risk.
[EXTERNAL_DOWNLOADS]: As part of its research workflow described in references/00-research-standards.md, the skill identifies and downloads PDF documents from arbitrary external domains for analysis.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests and processes untrusted content from the public internet and external databases.
Ingestion points: Data is fetched from the web, PubMed, and ClinicalTrials.gov across all research phases (1-4).
Boundary markers: There are no explicit delimiters or instructions provided to the agent to disregard potentially malicious instructions embedded in the retrieved content.
Capability inventory: The skill has the ability to execute shell commands (curl, mkdir) and write files to the local file system.
Sanitization: While there is a specific mitigation for URL injection in the curl command, there is no evidence of sanitization or filtering for the text content being processed during the synthesis phase.

indication-dossier