The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes external binaries to perform LaTeX-specific tasks and version control operations.
Executes the latexdiff binary in src/latexdiff.ts using execFile with a structured argument array, which mitigates shell injection risks.
Executes git commands in src/remote-helper.ts to manage the remote tracking state.
[EXTERNAL_DOWNLOADS]: Interacts with remote servers to manage project data.
Downloads project archives (ZIP) and compile artifacts (PDF, BBL, logs) from www.overleaf.com or user-configured self-hosted instances.
Installation instructions point to well-known services (Homebrew tap and npm registry).
[INDIRECT_PROMPT_INJECTION]: The skill handles data that could be influenced by external collaborators.
Ingestion points: Fetches document text, review comments, and project metadata which are returned to the agent context in src/client.ts and src/mcp-server.ts.
Boundary markers: The MCP server implementation includes explicit instructions and notices to the agent regarding untrusted content.
Capability inventory: State-changing capabilities include deleting, renaming, and uploading files, as well as managing project comments.
Sanitization: Implements a robust 'write confirmation' system requiring human approval for all mutation operations. It also makes control, zero-width, and bidirectional formatting characters visible in the confirmation dialog to prevent spoofing attacks.
[CREDENTIALS_UNSAFE]: Handles sensitive authentication data for project access.
Stores session cookies and optionally account passwords in plaintext on disk in a platform-standard configuration directory or a local .olauth file. While standard for CLI tools, users are explicitly warned about the --save-password flag in the CLI help text.

overleaf