The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/validate_format.py uses subprocess.run to execute external PDF utilities like pdfinfo and pdffonts for format verification. The implementation uses a list-based argument structure and avoids shell=True, which is the recommended method for preventing command injection vulnerabilities. These calls are used strictly for extracting document metadata and font names as part of the tool's documented functionality.
[PROMPT_INJECTION]: The skill contains an indirect prompt injection surface in scripts/customize_template.py, where user-provided inputs (such as paper titles and author names) are inserted into LaTeX templates via regex substitution. Since these inputs are not sanitized, a malicious user could potentially include LaTeX commands. This risk is inherent to the tool's primary purpose of generating documents from user input and is characteristic of the skill's operational requirements.
[SAFE]: All external URLs and resources cited in the reference files (such as links to Nature, Science, and PLOS author guidelines) point to official and well-known academic domains. These references are used legitimately to provide users with the most current submission requirements and do not involve untrusted code downloads.

venue-templates