The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided academic text via the input_text parameter, creating a surface for indirect prompt injection where malicious instructions could be embedded in the text to be polished. * Ingestion points: The input_text field is defined in SKILL.md and agents/interface.yaml and is processed by the agent to generate polished output. * Boundary markers: The skill implements a mechanism to identify and protect specific tokens (citations, references, and numbers) using the _TOKEN regex in scripts/core.py, but it does not employ robust delimiters or clear 'ignore' instructions to separate user content from system instructions at the prompt level. * Capability inventory: Analysis of all scripts, including scripts/core.py, confirms an absence of high-risk capabilities; the skill does not have access to network APIs, file writing tools, or shell execution commands. * Sanitization: There is no evidence of input validation or sanitization to filter out potential injection strings from the input_text before it is processed by the language model.
[DYNAMIC_EXECUTION]: Local test scripts and evaluation runners, such as tests/conftest.py and evals/output_contract_eval.py, dynamically modify the Python module search path (sys.path) to load the core skill logic. This path manipulation is restricted to local directory structures and is standard for development and automated testing environments.

paper-writing-studio