The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-supplied data from files such as the manuscript (manuscript/manuscript.md), project configurations (project.yaml), and bibliography databases (refs.bib). These files act as ingestion points where an attacker could embed malicious instructions to manipulate the agent's behavior during automated writing, review, or polish phases.
Ingestion points: project.yaml, manuscript/_src/refs.bib, manuscript/manuscript.md, and manuscript/index.qmd.
Boundary markers: Not explicitly implemented to isolate instructions from the data processed during automated edit and fix loops.
Capability inventory: The skill has extensive permissions including Bash, Write, Edit, Glob, and Read, and it orchestrates multiple sub-skills for analysis and figure generation.
Sanitization: Processing is primarily based on regex for formatting and placeholder detection, lacking semantic sanitization for potential prompt injection.
[COMMAND_EXECUTION]: The skill uses the Bash tool to execute local Python scripts (gate_backbone_fulltext.py, build_title_page_affiliations.py, check_placeholders.py) and standard utilities like grep and pandoc for manuscript linting and document building. These operations are conducted within the local file system using hardcoded or validated paths.

write-paper