The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes external research data and metadata, creating a surface for indirect prompt injection if source documents are maliciously crafted.
Ingestion points: The evidence.yml store, synchronized content from Overleaf, and local Quarto (.qmd) and LaTeX (.tex) files.
Boundary markers: The what-changed.py utility includes a built-in allowlist-based HTML sanitizer to prevent script execution when viewing diffs.
Capability inventory: The skill possesses significant capabilities, including shell access via Bash (SKILL.md), and file modification via Write and Edit tools.
Sanitization: what-changed.py uses the sanitize_fragment function to filter out <script>, <style>, and other potentially dangerous tags and attributes from embedded page content.
[EXTERNAL_DOWNLOADS]: Managed assets and themes are downloaded from the author's trusted organization on GitHub.
Evidence: assets/Makefile and assets/workspace.mk contain logic to download tarballs from github.com/allenai/asta-plugins using curl.
Context: The downloads target a recognized, trusted organization and are necessary for the skill's infrastructure.
[COMMAND_EXECUTION]: The skill automates project tasks by executing shell and CLI commands.
Evidence: Python scripts (paper-discovery.py, paper-viewer.py, what-changed.py) and shell scripts (wait-for-preview.sh) invoke git, gh, and quarto via subprocesses.
Context: Command execution is scoped to managing the research project's lifecycle, such as tracking changes, rendering documents, and interacting with GitHub APIs.

workspace