The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill automatically loads and trusts project-level configuration files and custom agent definitions without explicit sanitization, which could be exploited by malicious content within a project repository.
Ingestion points: Reads .claude/CLAUDE.md, .claude/agents/*.md, and .tex files from the working directory as described in the context loading section of SKILL.md.
Boundary markers: Does not specify the use of delimiters or 'ignore embedded instructions' warnings when passing untrusted file content to sub-agent prompts.
Capability inventory: The orchestrator and its sub-agents have access to powerful tools including Bash, Edit, Write, WebFetch, and WebSearch.
Sanitization: There is no mention of sanitizing or validating markdown content or frontmatter from project-specific agent definitions before they are added to the active roster.
[COMMAND_EXECUTION]: The skill utilizes the Bash tool for project-related shell commands.
Evidence: The 'Incremental Review' section in SKILL.md explicitly calls for running git diff --name-only to identify changed files.
[EXTERNAL_DOWNLOADS]: The skill performs network operations to interact with research APIs.
Evidence: The paper-crawler agent is designed to collect data from DBLP and OpenAlex APIs using the WebFetch tool. These are well-known academic services and the use is consistent with the skill's primary purpose.

academic