The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: Fetches academic paper metadata and citation information from export.arxiv.org and api.semanticscholar.org. These are well-known and established academic resources for the research community.
[COMMAND_EXECUTION]: Uses curl to interact with REST APIs and python3 to parse XML and JSON data. These commands are used legitimately for data retrieval and formatting, which is consistent with the skill's primary research purpose.
[REMOTE_CODE_EXECUTION]: Automated alerts identified the pattern of piping curl output to python3. Analysis confirms this is used to parse API responses using local Python code provided directly in the skill's instructions (via the -c flag), rather than executing untrusted remote scripts. No direct execution of remote code was found.
[PROMPT_INJECTION]: The skill ingests untrusted data from academic paper titles and abstracts. This presents a surface for indirect prompt injection, which is a common risk when processing external web content, and is generally mitigated by model-level safety guardrails.

arxiv