The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests content from external bibliography files (e.g., titles, abstracts, and annotations) and presents it to the agent for review. An attacker could embed malicious instructions within these fields to influence the agent's behavior. \n
Ingestion points: The scripts/search_bib.py script reads the content of user-provided .bib files, specifically targeting text fields like abstract and annotation. \n
Boundary markers: There are no explicit instructions or code-level delimiters used to wrap the bibliographic content to prevent the agent from interpreting embedded text as instructions. \n
Capability inventory: The agent environment includes Bash and Read tools, which could be targets for exploitation if the agent is misled by malicious data. \n
Sanitization: The script performs text normalization for search purposes but does not filter or sanitize the content for natural language instructions before displaying results to the agent. \n- [COMMAND_EXECUTION]: The test suite (tests/test_bib_search.py) uses subprocess.run to execute the search and preview scripts. \n
Evidence: The run_python_script function executes the Python interpreter with script paths and arguments. This is a standard and safe practice for unit testing and does not utilize shell=True for arbitrary command execution.

bib-search-citation