The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection because its core function involves processing untrusted external data (PDFs, repositories, logs) and converting it into structured knowledge. Malicious instructions embedded in these inputs could attempt to override agent behavior during the 'READ' and 'REASON' phases.
Ingestion points: Processes arbitrary research inputs via file paths, URLs, and descriptions provided in $ARGUMENTS (SKILL.md).
Boundary markers: No explicit boundary markers or 'ignore' instructions are mandated when reading the raw contents of untrusted PDFs or repositories.
Capability inventory: Access to Bash (python, git clone, ls, mkdir), Write, and Edit tools allows for file modification and code execution.
Sanitization: Implements a 4-stage epistemic chain-of-thought and a 'Seal Level 1' validation protocol to verify the structure and grounding of the output, which serves as a mitigation layer.
[COMMAND_EXECUTION]: The skill uses the Bash tool to perform administrative and processing tasks within the agent's environment.
Evidence: Explicitly allows and instructs the use of ls and mkdir for environment setup, and python for data extraction tasks.
[REMOTE_CODE_EXECUTION]: The skill can generate and execute code derived from untrusted research sources.
Evidence: Instructions in SKILL.md and figure-extraction-guide.md direct the agent to use python with libraries such as PyMuPDF (fitz) or pdf2image to process figures. Furthermore, the skill directs the agent to transcribe code artifacts from research papers or repositories into src/execution/ files, creating a path for untrusted code to be stored and potentially executed.
[EXTERNAL_DOWNLOADS]: The skill allows for downloading external content from arbitrary remote sources.
Evidence: The allowed-tools configuration and workflow instructions explicitly permit the use of git clone to fetch research repositories from user-supplied URLs.

compiler