The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/validate_format.py utilizes subprocess.run() to execute the system utilities pdfinfo and pdffonts for document analysis.
Evidence: Lines 56 and 86 in scripts/validate_format.py show command execution using list-based arguments.
Assessment: The implementation is secure because it does not use shell=True, preventing shell injection vulnerabilities. The use of these tools is appropriate for the skill's purpose of validating PDF formatting against venue requirements.
[PROMPT_INJECTION]: The skill defines a data ingestion surface by reading and processing user-provided LaTeX and PDF files.
Evidence: scripts/customize_template.py reads LaTeX files for placeholder replacement, and scripts/validate_format.py parses PDF metadata.
Assessment: This represents an indirect prompt injection surface; however, the risk is negligible as the processing logic is restricted to specific regex substitutions and metadata extraction without passing raw content to an execution context.
[SAFE]: A comprehensive scan of the skill's 25 files, including templates, reference guides, and Python scripts, revealed no evidence of obfuscation, hardcoded credentials, or data exfiltration.
Context: The skill refers to an external tool generate_schematic.py in its documentation which is not present in the package, likely referring to a companion skill. All referenced external URLs are official scientific journals and funding agencies.

alterlab-venue-templates