The Agent Skills Directory

[COMMAND_EXECUTION]: The skill contains a shell command injection vulnerability in Step 1a. The variable USER_INPUT is populated with raw user data (<user-input>) and then used directly within a Bash script's conditional block and as an argument to a Node.js script. An attacker could provide a malicious string (e.g., ; touch /tmp/pwned; #) to execute arbitrary commands on the host.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from research papers (PDFs/URLs) to generate summaries. This is an attack surface where a malicious document could contain hidden instructions designed to override the agent's behavior during summary generation.
Ingestion points: Processes external PDFs via URL or local path in Step 1.
Boundary markers: No explicit delimiters or instructions are provided to the model to ignore embedded commands within the PDF text during the summary phase.
Capability inventory: The agent has access to Bash, Write, and Read tools, and executes shell commands to download and parse files.
Sanitization: None detected; the raw extracted text from paper.txt is passed to the generation prompt.
[EXTERNAL_DOWNLOADS]: The skill automatically installs external software during its first run. It executes npm install and downloads the Python package pymupdf using pip. While these are common libraries, executing unpinned installation commands at runtime poses a supply-chain risk.
[DYNAMIC_EXECUTION]: The skill generates and executes shell scripts dynamically to manage file organization and update an index file (index.json). Errors in how the agent handles these file paths or slugs could lead to path traversal or unintended file modifications.

summary