The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using the Bash tool, specifically python scripts/generate_schematic.py "your diagram description" -o figures/output.png. This pattern is vulnerable to command injection because it interpolates unvalidated natural language descriptions directly into a shell command; an attacker could provide a description containing shell metacharacters to execute arbitrary code. Additionally, the skill references and executes external scripts (scripts/generate_schematic.py and skills/scientific-slides/scripts/pdf_to_images.py) that are not provided in the skill package for verification.
[PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection (Category 8) due to its core functionality of reading and evaluating external, potentially untrusted scientific manuscripts and presentation slides. (1) Ingestion points: Untrusted content is ingested when the agent reads manuscript files, grant proposals, and converts PDF slide decks to images for review. (2) Boundary markers: There are no explicit instructions or delimiters used to isolate external text or to warn the agent to ignore any embedded instructions within the documents being reviewed. (3) Capability inventory: The agent possesses significant capabilities, including the ability to execute shell commands via Bash and modify files via Write and Edit tools. (4) Sanitization: No sanitization, filtering, or validation is performed on the text extracted from the manuscripts or slides before the agent processes and interprets it.

alterlab-peer-review