The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection because it processes untrusted data from user-provided .tex and .bib files (as seen in phases/01-scan-extract.md) to perform verification steps.\n
Ingestion points: Reads citation metadata (titles, authors) from local academic paper files.\n
Boundary markers: The instructions lack explicit delimiters or sanitization rules to differentiate between citation metadata and potential malicious instructions embedded in the data fields.\n
Capability inventory: The agent utilizes Bash, Write, and WebSearch tools, which represent the capability tier accessible if an injection were successful.\n
Sanitization: No specific sanitization or escaping of the extracted citation strings is performed before they are interpolated into queries or processed by the agent.\n- [DATA_EXFILTRATION]: The skill performs legitimate network operations to well-known academic services to fulfill its primary function of citation verification.\n
Evidence: Requests are directed to official APIs for CrossRef (api.crossref.org), arXiv (export.arxiv.org), and Semantic Scholar (api.semanticscholar.org), as well as targeted searches on Google Scholar (scholar.google.com), as documented in phases/02-verify.md and references/api-usage.md. These operations are consistent with the skill's stated purpose and use established technology domains.\n- [COMMAND_EXECUTION]: The skill utilizes the Bash tool to perform file discovery, scanning, and parsing operations as part of its automated workflow.\n
Evidence: The orchestrator in SKILL.md and the extraction logic in phases/01-scan-extract.md describe using system tools to traverse directories and extract citation keys from paper source files.

scholar-citation-verify