The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection vulnerability surface where untrusted data is processed and passed to sub-agents and external CLI tools.
Ingestion points: Reviewer comments are ingested from external files or inline text in Phase 1, and paper content is loaded in Phase 3.
Boundary markers: While the skill uses some markdown formatting like blockquotes to delimit content, it lacks robust boundary markers or explicit instructions to ignore potentially malicious commands embedded in the processed reviewer comments or papers.
Capability inventory: The skill has access to powerful tools including Bash (shell access), Write and Edit (filesystem modification), and Task (sub-agent execution).
Sanitization: There is no evidence of sanitization or filtering of the input text before it is interpolated into prompts for the agy CLI tool or the rebuttal-writer agent.
[COMMAND_EXECUTION]: The skill frequently uses the Bash tool to interact with platform-specific CLI tools.
It executes ccws pdf-convert to convert PDF documents to markdown.
It uses ccw cli with the agy tool for semantic analysis, evidence gathering, and quality validation across multiple phases.
Shell commands are dynamically constructed using variables derived from user-provided files (e.g., issue.text, paperPath), which could lead to command injection if filenames or file contents are maliciously crafted.
[DATA_EXFILTRATION]: The skill accesses configuration and workflow files located in the user's home directory.
The SKILL.md orchestrator reads from ~/.maestro/workflows/run-mode.md.
The documentation refers to ~/.claude/cli-tools.json for tool configuration. While these are specific to the operating environment, access to the home directory for configuration management is a sensitive behavior.

scholar-rebuttal-pro