The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest untrusted user data—such as research notes, manuscript drafts, and literature results—to generate scientific prose. This creates a surface where malicious instructions hidden in the processed data could influence the agent's output.
Ingestion points: Scientific manuscripts, abstracts, research notes, and literature search results (SKILL.md).
Boundary markers: The instructions lack specific delimiters or warnings for the agent to ignore embedded instructions within the ingested text.
Capability inventory: The skill provides instructions for executing shell commands and Python scripts (SKILL.md).
Sanitization: There are no documented procedures for sanitizing or validating user input before it is interpolated into prompts or command arguments.
[COMMAND_EXECUTION]: The skill contains instructional examples for executing a Python script (generate_openrouter_schematic.py) using arguments such as --title and --panel-map. If these parameters are populated directly from untrusted manuscript content, it presents a potential command injection vulnerability.
Evidence: Execution of python ~/.codex/skills/nature-figure/scripts/generate_openrouter_schematic.py with user-controlled string parameters in SKILL.md.

scientific-writing