The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute a shell command to create directory structures using the user-provided workdir variable (mkdir -p "<workdir>/waypoints" in references/01-meta-initialization.md). This creates a risk of command injection if the variable contains shell metacharacters.
[COMMAND_EXECUTION]: The skill directs the agent to download PDF files using curl with URLs harvested from untrusted web sources (curl -L -o file.pdf '<url>' in references/00-research-standards.md). While the prompt provides manual safety advice to single-quote the URL and check for metacharacters, this pattern remains susceptible to command injection if the agent fails to properly sanitize the remote-sourced string.
[INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted content from the web and literature databases to perform high-stakes operations like file writing and shell execution without adequate boundary markers.
Ingestion points: Data returned by the WebSearch, WebFetch, and pubmed MCP tools during research phases.
Boundary markers: No explicit delimiters or instructions to ignore embedded commands are present in the data processing instructions.
Capability inventory: The skill utilizes shell execution capabilities (curl, mkdir) and file system write operations for waypoints and report generation.
Sanitization: The instructions rely on manual AI validation for shell metacharacters in URLs rather than programmatic sanitization or strict schema enforcement for processed content.

indication-dossier