The Agent Skills Directory

[DATA_EXFILTRATION]: The litrev_contact function in kernel.py retrieves the user's email address from the local system by checking environment variables (HOST_USER_EMAIL, CONTACT_EMAIL) and falling back to executing git config user.email. This information is then included in the User-Agent HTTP header for all requests to api.crossref.org. Although documented in the skill's metadata as a requirement for the Crossref 'polite pool', this behavior performs automated extraction and remote transmission of PII from local configuration files.
[COMMAND_EXECUTION]: The script kernel.py utilizes subprocess.run to execute the git CLI on the host machine to access user configuration details.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and synthesize large volumes of untrusted text (abstracts and metadata) from external scientific databases.
Ingestion points: Untrusted data enters the agent context via the litrev_get and litrev_openalex_get functions in kernel.py which fetch JSON content from Crossref and OpenAlex APIs.
Boundary markers: The instructions do not specify prompt-level delimiters or 'ignore' instructions for the retrieved data, relying on the model's inherent reasoning to distinguish data from instructions.
Capability inventory: The skill possesses network request capabilities via urllib and local command execution via subprocess.run.
Sanitization: The skill performs basic HTML entity decoding and uses a deterministic Python linting function (style_pass) to review the final output, which partially mitigates the risk of malicious content influencing the final artifact generation.
[DYNAMIC_EXECUTION]: The SKILL.md instructions direct the agent to load operational logic by executing the local kernel.py file using the exec(open(...).read()) pattern.

literature-review