The Agent Skills Directory

[COMMAND_EXECUTION]: The workflow in SKILL.md interpolates shell variables ($TITLE, $AUTHORS, $DOMAIN, $SCORE) sourced from external arXiv metadata into command line arguments. Because these variables are passed to scripts like generate_note.py within a shell context, an attacker providing a paper with a malicious title (e.g., containing backticks or $(...) syntax) could trigger arbitrary command execution on the host system.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an unsafe data ingestion pattern when processing external academic content:
Ingestion points: The skill fetches PDFs, source files, and HTML metadata from arXiv using curl as defined in the SKILL.md workflow.
Boundary markers: There are no delimiters or specific instructions provided to the agent to distinguish between the skill's instructions and potentially malicious content embedded in the fetched papers.
Capability inventory: The skill has broad capabilities, including writing to the local filesystem and performing network operations.
Sanitization: Content fetched from arXiv is interpolated directly into Markdown and JSON files without validation or escaping.
[EXTERNAL_DOWNLOADS]: The skill downloads content from arxiv.org to a local temporary directory for analysis. While arXiv is a recognized academic service, the automated download and subsequent metadata extraction without integrity verification provides a vector for exploitation if the metadata is crafted to exploit the command execution or path traversal vulnerabilities mentioned above.
[PRIVILEGE_ESCALATION]: The scripts/generate_note.py script is vulnerable to path traversal. The domain argument is used directly in os.path.join to construct the output directory path. A malicious input containing parent directory references (e.g., ../../) would allow the skill to write files to unauthorized locations on the filesystem, bypassing the intended vault directory structure.

paper-analyzer